Filters are great but they appear to default to AND logic versus OR logic - why not offer both? Throw up a checkbox and be done with it.

Question

I love the process monitor software. It's great for detailed information. I'm no expert about using it since I have just started recently but it appears to me that the filters are using AND logic where EVERY filter has to be true to display a captured event. I couldn't understand why some events were not being captured. I was just assuming OR logic. Why not offer both as options for the end user? Throw up a checkbox on the filter screen selecting AND or OR logic so that the end user can make their own decisions about the logic to use.

Answer 1

If it used AND, you could not watch several processes...

For example, this watches mmc OR SystemSettings.exe processes :

Answer 2

I think filters on the same column (i.e. two filters on Process Name) operate as logical OR and filters on different columns (i.e. one filter on Process Name and one filter on Path) operate as logical AND.