# microsoft/ProcMon-for-Linux

A Linux version of the Procmon Sysinternals tool

Repository: https://github.com/microsoft/ProcMon-for-Linux
Canonical: https://ross.abutalabs.com/products/procmon-for-linux
Language: C
License: MIT
License Family: permissive
Last push: 2026-05-07T17:47:31+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 81, release rhythm 59, longevity 100
- inputs: {"age_days": 2245, "days_push": 118, "days_rel": 118, "gap_med": 153.0, "n_releases_24m": 3}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4729, forks 294 (observed 2026-08-28T04:08:57.650085+00:00)

## What it is
A Linux reimagining of the classic Sysinternals Process Monitor (Procmon) tool, providing a convenient and efficient way for Linux developers to trace syscall activity on the system. It offers an interactive TUI for live monitoring, filtering by process IDs and syscall names, and headless collection to SQLite trace files that can be reopened later.

## Use cases
- trace syscall activity on linux
- monitor system calls for a specific process
- debug why a program fails to open a file
- capture syscall traces headlessly to a file for later analysis
- filter syscall events by process id and syscall name
- replay a previously captured procmon trace file

## When to choose
- you need a Sysinternals-style process monitor on Linux
- you want an interactive TUI to watch syscalls live with filtering by PID or syscall
- you need to record syscall activity headlessly to a trace file and inspect it later
- you are debugging unexpected file, network, or process behavior at the syscall level

## When to avoid
- you need kernel-level performance profiling rather than syscall tracing
- you require strace-style per-process attachment with argument decoding
- you need a cross-platform tool that also runs on Windows or macOS
- your environment cannot run the tool with root privileges or lacks the supported Ubuntu base

## Facets
- artifact type: cli-tool
- maturity: active
- function: monitoring, tracing, developer-tools, terminal-ui
- domain: developer-tools, operating-systems, monitoring
- platform: cli
- tags: sysinternals, syscall-tracing, system-monitoring, process-monitoring, ebpf, tui, sqlite-trace-files, microsoft, command-line, linux

## Member repositories
- microsoft/ProcMon-for-Linux (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:57.650085+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:19:02.197852+00:00, confidence not recorded.
  - readme: https://github.com/microsoft/ProcMon-for-Linux (fetched 2026-08-28T04:08:57.650085+00:00, sha 3d56be553eb5)
- Data as of 2026-08-30T08:39:29.467469+00:00.