pyotr filipivich wrote:

VanguardLH :

As soon as you enable it capturing events, yep, it is LOGGING. The

How do I enable it to capture events?

When you load ProcMon, it is already enabled to capture (logging). Even
if you disabled it in a prior session of ProcMon, a new session of
ProcMon will have logging enabled by default.

Or unable that?

Mentioned in my first reply to you.