Skip to content

GabriWar/ProcMon-for-ARCH-Linux

 
 
in this fork you **should** be able to just build procmon as below on arch linux
BUT FIRST compile the sysinternalsEBPF from the original github repo: https://github.com/microsoft/SysinternalsEBPF/blob/main/BUILD.md (i swear its just 3 or 4 commands)


Process Monitor for Linux (Preview) Build Status

Process Monitor (Procmon) is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system.

Procmon in use

Build Procmon

Please see build instructions here.

Usage

Usage: procmon [OPTIONS]
   OPTIONS
      -h/--help                Prints this help screen
      -p/--pids                Comma separated list of process IDs to monitor
      -e/--events              Comma separated list of system calls to monitor
      -c/--collect [FILEPATH]  Option to start Procmon in a headless mode
      -f/--file FILEPATH       Open a Procmon trace file
      -l/--log FILEPATH        Log debug traces to file

Examples

The following traces all processes and syscalls on the system:

sudo procmon

The following traces processes with process id 10 and 20:

sudo procmon -p 10,20

The following traces process 20 only syscalls read, write and open at:

sudo procmon -p 20 -e read,write,openat

The following traces process 35 and opens Procmon in headless mode to output all captured events to file procmon.db:

sudo procmon -p 35 -c procmon.db

The following opens a Procmon tracefile, procmon.db, within the Procmon TUI:

sudo procmon -f procmon.db

Feedback

  • Ask a question on Stack Overflow (tag with ProcmonForLinux)
  • Request a new feature on GitHub
  • Vote for popular feature requests
  • File a bug in GitHub Issues

Contributing

If you are interested in fixing issues and contributing directly to the code base, please see the document How to Contribute, which covers the following:

  • How to build and run from the source
  • The development workflow, including debugging and running tests
  • Coding Guidelines
  • Submitting pull requests

Please see also our Code of Conduct.

License

Copyright (c) Microsoft Corporation. All rights reserved.

Licensed under the MIT License.

About

A Linux version of the Procmon Sysinternals tool actually compiling in arch

Resources

License

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C 78.9%
  • C++ 20.5%
  • Other 0.6%