Process Monitor v3.82, TCPView v4.12, Process Explorer v16.42 and Sysmon v13.21

Hi Alex,

Hi Mark,

i would like to ask you the following things.

1. Why do the information regarding the system load caused by "Context Switches" in the Process Explorer sometimes deviate very seriously from the values,
that I get to see through the performance monitor?

2. It used to be called that a system load of more than 2000 "Context Switches/s" is already to be regarded as critical.
However, I see much higher values ​​with current systems.
At what value does the load from "context switches" become critical in newer systems?

Many thanks and best regards from Germany

Alex

Whaddayknow, that fixed it.

Can you make Process Explorer Disk History (also Network History) Tray Icon tooltip show the usage rate?

Since the update, I cannot set Process Monitor to run on startup.

Getting the following error:

Process explorer shows no errors.

Hey Timothy,

should have been fixed in the past release, v13.20, already. v13.21 further improves on the events with multiple ids under the same name (Pipe, Registry, WMI) so please, let us know if you're still getting unexpected results with your setup.

When can we expect fixes for sysmon "and" / "or" filtering bug and the EID 13 "Details" bug?

https://docs.microsoft.com/en-us/answers/questions/401499/sysmon-possible-andor-in-rulegroup-issue.html
https://docs.microsoft.com/en-us/answers/questions/332062/sysmon-help-im-unable-to-filter-on-eid-13-data-nam.html

Thanks, Team!