4 ms·
I think you’re mistaken. ProcMon doesn’t use ETW on Windows and I don’t believe it ever did?
by altano 5y ago
I think you’re mistaken. ProcMon doesn’t use ETW on Windows and I don’t believe it ever did?
- ale42 5y agoIndeed I don't think so. ProcMon uses a kernel driver for the event tracing.
- bboreham 5y agoSorry about that; I guess I misremembered? This file says it does, though only for network events: https://documentation.help/Process-Monitor/documentation.pdf https://documentation.help/Process-Monitor/documentation.pdf