Monitoring FCS scanned files

I'm trying to monitor all scanned files, just to add some of them to the
exclusion list. Files with extension log or tmp are some of these files.
Using Microsoft Process Monitor, i'm using a filter like:
process Name = msmpeng.exe
operation = queryopen
operation = querystandardinformation

But despite adding files to the exclusion list, they still show up in
process monitor.
Does anyone know how to be sure, by monitoring with process monitor,
that these filtered files are no longer scanned bij Forefront Client?

Or does anyone know a better way?

Thank for any reply

I believe the operation = ReadFile

> I'm trying to monitor all scanned files, just to add some of them to the
> exclusion list. Files with extension log or tmp are some of these files.
> Using Microsoft Process Monitor, i'm using a filter like:
> process Name = msmpeng.exe
> operation = queryopen
> operation = querystandardinformation
>
> But despite adding files to the exclusion list, they still show up in
> process monitor.
> Does anyone know how to be sure, by monitoring with process monitor,
> that these filtered files are no longer scanned bij Forefront Client?
>
> Or does anyone know a better way?
>
> Thank for any reply