microsoft/ProcMon-for-Linux

Health v2 · maintenance only

Adoption not part of the score

4729 stars · 294 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A Linux reimagining of the classic Sysinternals Process Monitor (Procmon) tool, providing a convenient and efficient way for Linux developers to trace syscall activity on the system. It offers an interactive TUI for live monitoring, filtering by process IDs and syscall names, and headless collection to SQLite trace files that can be reopened later.

Use cases

• trace syscall activity on linux
• monitor system calls for a specific process
• debug why a program fails to open a file
• capture syscall traces headlessly to a file for later analysis
• filter syscall events by process id and syscall name
• replay a previously captured procmon trace file

When to choose

• you need a Sysinternals-style process monitor on Linux
• you want an interactive TUI to watch syscalls live with filtering by PID or syscall
• you need to record syscall activity headlessly to a trace file and inspect it later
• you are debugging unexpected file, network, or process behavior at the syscall level

When to avoid

• you need kernel-level performance profiling rather than syscall tracing
• you require strace-style per-process attachment with argument decoding
• you need a cross-platform tool that also runs on Windows or macOS
• your environment cannot run the tool with root privileges or lacks the supported Ubuntu base

Facets

cli-tool · maturity active

monitoring tracing developer-tools terminal-ui developer-tools operating-systems monitoring cli sysinternals syscall-tracing system-monitoring process-monitoring ebpf tui sqlite-trace-files microsoft command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="microsoft/ProcMon-for-Linux")