@Fringedcrow@infosec.exchange I think you can set procmon to use a file with a max size instead of memory.