Removing near-duplicate rows in Filemon / Process Monitor to more easily analyze OS operations

Question

Process Monitor allows great power when it comes to filtering, but it doesn't do something which seems extremely simple and beneficial, which is to simply allow the option to remove rows which are nearly the same, and where there can be hundreds or thousands of these rows, and they really complicate trying to find other transactions.

For example, take a look at this image:=

(I censored some info with the red bar, but they're all the same filename).

Wouldn't it be great to be rid of that file ending with .automaticDestinations-ms, even if it's just for the same second's worth of time? It can always allow it again, after a second's worth of transactions has passed.

Here's another example:

Again, I don't want to see Irfanview updating its .ini file 1 zillion times, specifying every single time it locks, queries, reads, writes, unlocks, or whatever else it apparently wants to do.

Is there a way to do remove these duplicates from within Process Monitor, or perhaps there's similar software that can perform this fundamental task on the fly? I don't want to have to manipulate the log file with other software.

To be clear, I only want the duplicates gone, I would still like to see one UNIQUE entry for any of these transactions.

Answer 1

Process Monitor contains several summary tools that can help in summing up the activity as regarding the targets. Unlike the main display of Process Monitor, these can at least be sorted on their columns:

Here for example is the registry summary sorted on the key:

That is the limit of the tools available using Process Monitor. More advanced tools can only be found outside of Process Monitor, by exporting the data, converting the data file to readable format, and sorting that data while only keeping unique values.

I will be using Excel for doing the sort, but numerous other utilities are also possible.

1. Save the data in Process Monitor via menu File → Save.... This creates a file with a .PML extension which is in an unreadable proprietary format. Let's call it Logfile.PML.

2. Use Process Monitor to convert the file to .csv format using:

   "C:\Program Files\Process Monitor\Procmon.exe" /Openlog Logfile.PML /SaveAs output.csv
   

3. Import the file into Excel:

   • Start an empty workbook
   • Select Data on the ribbon
   • Click From Text
   • Browse for output.csv and click Import
   • In the Text Import Wizard, select Delimited and My data has headers, then click Next
   • Select Comma, then click Next
   • Leave General selected (or if you prefer choose Text)
   • Click Finish
   • Select Existing worksheet and click OK.

4. Filter for unique values or remove duplicate values for one column:

   • Click on top of the column in question to select the entire column
   • To filter for unique values, click Data → Sort & Filter → Advanced, choose Unique records only, and click OK
   • To remove duplicate values, click Data → Data Tools → Remove Duplicates, select Continue with the current selection and click Remove Duplicates...

There are other free utilities that can process .csv files besides Excel, if you don't have it available.