On Thu, 19 Oct 2006, Vitaliy Margolen wrote: [...]
Yes sorry you are correct.
For some reason I thought it removed all relay traces from those dlls. But it removes only traces from internal calls to those dlls.
Actually your first impression was right. RelayFromExclude filters out relay traces of calls made by (that is *from*) the specified dlls. However you will still see calls made *to* these dlls.
Here are some practical examples. If RelayFromExclude="kernel32;user32"
Module making | Module containing | Relay trace the call | the called API | in the log? --------------+-------------------+------------- app | user32 | Yes app | kernel32 | Yes user32 | gdi32 | No user32 | kernel32 | No gdi32 | kernel32 | Yes kernel32 | ntdll | No