When reviewing a DNS request in the Event Search, you're curious which process made the request. Which Event Action would be the quickest way to show you the process?
A.
Show Associated Event Data (from TargetProcessID_decimal)
event_simpleName=DnsRequest is a process that is spawned by a TargetProcessId that is 'event_simpleName=ProcessRollup2'. It doesn't have a ParentProcessId in the field hence B is wrong.
C is correct because by clicking 'Show Responsible Process Data', it automatically pivots the event's ContextProcessId as the TargetProcessId to find its 'spawner'.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
alanalanalan
3 months, 3 weeks agokangaru
10 months, 1 week agoSunaperi
1 year ago