☰

如何将 Procmon 中的过滤结果保存到.csv 文件？

tag-icon • tag-icon microsoft-outlook csv procmon
如何将 Procmon 中的过滤结果保存到.csv 文件？

我已将整个脚本包含在下方。即使没有第 16 行添加的这一段，它也能正常工作。如果我删除第 16 行添加的代码，脚本将完成，但不会保存过滤的信息。

/LoadConfig C:\Temp\ProcmonOutlookConfiguration.pmc /SaveApplyFilter /SaveAs C:\Temp\outlook.csv /Quiet

我通过调试器运行了该脚本并设置了多个断点。在第 16 行添加部分后，该脚本无法完成，并且似乎在第 21 行和第 22 行陷入了循环。

问题：我该如何解决这个问题，以便脚本正确完成并保存包含过滤信息的 .csv 文件？

clear-host 

$CSVFile = Read-Host "Enter CSV log file and path - (C:\temp\outlook.csv)"
$ProcMonTest = Read-Host "Enter app path - (C:\Program Files\Microsoft Office\Office16\OUTLOOK.EXE)"
$ProcMon = "C:\tools\Procmon.exe" # this would be the path to wherever procmon.exe is
$ProcMonBack = "C:\Temp\ProcMonTest.pml"
$LaunchBAT = Read-Host "Enter path to the BAT file to launch the app to be tested - (c:\tools\StartOutlook.bat)" # use a bat file to get past PowerShell security
$CredsForApp = $host.ui.PromptForCredential("Run App As?", "Enter creds in domain\username format to run testing app:", "", "") # this gives us the creds to run the app to be tested as 
 
# make sure backing file isn't present in case it wasn't deleted on last run
$FileExists = Test-Path $ProcMonBack
if ($FileExists -eq $true){
Remove-Item $ProcMonBack -force
}
 
& $ProcMon /AcceptEula /Minimized /backingfile $ProcMonBack /LoadConfig C:\Temp\ProcmonOutlookConfiguration.pmc /Quiet
 
do{
Start-Sleep -seconds 90 # procmon.exe /waitforidle doesn't appear to work well when scripted with PowerShell
$ProcMonProcess = Get-Process | where {$_.Path -eq $ProcMon}
}while(
$null -eq $ProcMonProcess.Id
)
(Start-Process cmd -Credential $CredsForApp -Argument "/c $LaunchBAT")

Start-Sleep -seconds 90 # adjust this time based on how long the test run is needed
 
$ProcMonTestProcess = Get-Process | where {$_.Path -eq $ProcMonTest}
Stop-Process $ProcMonTestProcess.Id -Force
 
& $ProcMon /Terminate
 
Start-Sleep -seconds 90 # procmon.exe can take a long time to exit, this ensures it does before proceeding
 
# Read the procmon.exe backing file and export as CSV
& $ProcMon /openlog $ProcMonBack /SaveAs $CSVFile
& $ProcMon /Terminate

Start-Sleep -seconds 60 # procmon.exe can take a long time to exit, this ensures it does before proceeding

# Clean up procmon.exe backing file
$FileExists = Test-Path $ProcMonBack
if ($FileExists -eq $true){
Remove-Item $ProcMonBack -force
}

答案1

经过进一步研究和重新安排脚本后，我终于找到了一个脚本，用于仅使用 Outlook 筛选结果保存 .csv 文件。这就是我所寻找的。最终代码如下。

clear-host 

$CSVFile = Read-Host "Enter CSV log file and path - (C:\temp\outlook.csv)"
$ProcMonTest = Read-Host "Enter app path - (C:\Program Files\Microsoft Office\Office16\OUTLOOK.EXE)"
$ProcMon = "C:\tools\Procmon.exe" # this would be the path to wherever procmon.exe is
$ProcMonBack = "C:\Temp\ProcMonTest.pml"
$LaunchBAT = Read-Host "Enter path to the BAT file to launch the app to be tested - (c:\tools\StartOutlook.bat)" # use a bat file to get past PowerShell security
$CredsForApp = $host.ui.PromptForCredential("Run App As?", "Enter creds in domain\username format to run testing app:", "", "") # this gives us the creds to run the app to be tested as 
$OutlookConfig = "C:\Temp\ProcmonOutlookConfiguration.pmc" #Path to the saved Outlook configuration file


# make sure backing file isn't present in case it wasn't deleted on last run
$FileExists = Test-Path $ProcMonBack
if ($FileExists -eq $true){
Remove-Item $ProcMonBack -force
}
 
& $ProcMon /Quiet /AcceptEula /Minimized /LoadConfig $OutlookConfig
 
do{
Start-Sleep -seconds 60 # procmon.exe /waitforidle doesn't appear to work well when scripted with PowerShell
$ProcMonProcess = Get-Process | where {$_.Path -eq $ProcMon}
}while(
$null -eq $ProcMonProcess.Id
)
(Start-Process cmd -Credential $CredsForApp -Argument "/c $LaunchBAT")

Start-Sleep -seconds 60 # adjust this time based on how long the test run is needed
 
$ProcMonTestProcess = Get-Process | where {$_.Path -eq $ProcMonTest}
Stop-Process $ProcMonTestProcess.Id -Force
 
& $ProcMon /Terminate
 
Start-Sleep -seconds 60 # procmon.exe can take a long time to exit, this ensures it does before proceeding
 
# Read the procmon.exe backing file and export as CSV with only filtered information
& $ProcMon /openlog $ProcMonBack /SaveAs $CSVFile /SaveApplyFilter 

Start-Sleep -seconds 60 # procmon.exe can take a long time to exit, this ensures it does before proceeding

& $ProcMon /Terminate

# Clean up procmon.exe backing file
$FileExists = Test-Path $ProcMonBack
if ($FileExists -eq $true){
Remove-Item $ProcMonBack -force
}

相关内容