Process Monitor (Procmon) is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system.

• OS: Ubuntu 18.04 lts
• cmake >= 3.14 (build-time only)
• libsqlite3-dev >= 3.22 (build-time only)

Please see installation instructions here.

Please see build instructions here.

Usage: procmon [OPTIONS]
   OPTIONS
      -h/--help                Prints this help screen
      -p/--pids                Comma separated list of process IDs to monitor
      -e/--events              Comma separated list of system calls to monitor
      -c/--collect [FILEPATH]  Option to start Procmon in a headless mode
      -f/--file FILEPATH       Open a Procmon trace file
      -l/--log FILEPATH        Log debug traces to file

The following traces all processes and syscalls on the system:

sudo procmon

The following traces processes with process id 10 and 20:

sudo procmon -p 10,20

The following traces process 20 only syscalls read, write and open at:

sudo procmon -p 20 -e read,write,openat

The following traces process 35 and opens Procmon in headless mode to output all captured events to file procmon.db:

sudo procmon -p 35 -c procmon.db

The following opens a Procmon tracefile, procmon.db, within the Procmon TUI:

sudo procmon -f procmon.db

• Ask a question on Stack Overflow (tag with ProcmonForLinux)
• Request a new feature on GitHub
• Vote for popular feature requests
• File a bug in GitHub Issues

If you are interested in fixing issues and contributing directly to the code base, please see the document How to Contribute, which covers the following:

• How to build and run from the source
• The development workflow, including debugging and running tests
• Coding Guidelines
• Submitting pull requests

Please see also our Code of Conduct.

Copyright (c) Microsoft Corporation. All rights reserved.

Licensed under the MIT License.