Procmon/Procdot quick tips

http://www.procdot.com/onlinedocumentation.htm

Per the readme.txt:
Important steps to follow
=========================

You need to adjust Procmon's configuration (actually for each Procmon installation you want to be compatible to ProcDOT) to match ProcDOT's needs.
Therefore, in Procmon ...
* disable (uncheck) "Show Resolved Network Addresses" (Options)
* disable (uncheck) "Enable Advanced Output" (Filter)
* adjust the displayed columns (Options > Select Columns ...)
  * to not show the "Sequence" column
  * to show the "Thread ID" column

Furthermore ProcDOT needs to know where its third party tools are located.
Hence, in ProcDOT ...
* choose your Windump/Tcpdump (windump.exe/tcpdump)) executable as fully qualified path (ProcDOT options)
* choose your Dot executable (dot.exe) as fully qualified path (ProcDOT options)

I have my Procmon link with the below Target options:
procmon.exe /Quiet /BackingFile C:\Users\<user>\Desktop\Logfile

the above will start procmon immediately, and will auto-create Logfile.PML.  After running I export out as csv, but I also save the generated Logfile.PML because if the csv file is too big we can go back to procmon, open up our Logfile.PML, exclude things we don't need, and then export and try again.