6 ms·
A Linux version of the Procmon Sysinternals tool
- perching_aix 1y agoIf this works remotely as well as the Windows version, I'm stoked. Polling for information (like with lsof) really rubs me the wrong way.
- calvinmorrison 1y agoreally? i have to use procman and associated utilities often and they really pale in comparison with linux and even moreso other unix utils (like dtrace)
- perching_aix 1y agoCare to expand on that? I'm similarly just forced to use Linux and its tooling ecosystem, so decent chances I'm simply missing what's cool/cooler.
- calvinmorrison 1y agoyes. I work with ancient and opaque tools that dont have good debugging / reporting facilities. Often we have to jump into procmon or whatever see why the heck the thing is stuck. something like strace is native and everywhere and you can sus out easily - hey this proc is trying to open this thing over and over. procmon is cool, but i have found it limited when the program isnt doing anything 'obvious', and also that i have to download it and run it from the web is a problem when debugging on client systems.
- sirjaz 1y agoWindows Server 2025 supports dtrace out of the box: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dtrace https://learn.microsoft.com/en-us/windows-server/administrat...
- cyberpunk 1y agoThis really is the weirdest timeline…
- actionfromafar 1y agoBut is it like the "real" dtrace or is like how PowerShell wget isn't actually wget but an alias for Invoke-WebRequest?
- p_ing 1y agoTwo seconds of investigation yields that it is a port of dtrace. https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace https://learn.microsoft.com/en-us/windows-hardware/drivers/d...
- actionfromafar 1y agoWell, true, but I'm not in a position to understand what that means. I remember talks about dtrace in Linux way back when and something about how "it's not the same thing, you have to add support in all of userspace which is not there" or something like that.
- lll-o-lll 1y agodtrace is more comparable to ETW in windows land. Procmon is more for quick and dirty analysis. Maybe there are other *nix tools that are more appropriate, but I look forward to trying this one out.
- deleted 1y ago[deleted]
- TiredOfLife 1y agoreally? One of the things I miss when using linux is resmon. I have not found anything that has even remotely the same functionality. For example seeing which process is using which files.
- olddustytrail 1y agoYou can do that with sysdig.
- bdhcuidbebe 1y agoThere’s multiple tools. For your stated issue, see lsfd https://www.man7.org/linux/man-pages/man1/lsfd.1.html https://www.man7.org/linux/man-pages/man1/lsfd.1.html
- 0x696C6961 1y agoCheck out sysdig.
- notepad0x90 1y agodoes this provide telemetry not available with strace? And is the output csv/logfile compatible with the windows equivalent? If so, that'd be amazing! tools like procdot can analyze/visualize the data: https://procdot.com/ https://procdot.com/
- xuhu 1y agoThis can trace all processes on the host while strace traces one PID and its descendants. And bpf tracing does not stop processes at each syscall, so they run without slowdowns.
- notepad0x90 1y agoI think auditd can trace all syscalls system wide and let you filter as well. But it is a daemon whereas this is a tool you can run and interact with.
- baranul 1y agoExpect Microsoft to come out with more Linux tools. The demand, interest, and requests are likely to only increase.
- notepad0x90 1y agoThey have one of the largest Linux user base out there in Azure. They have their own distro. My favorite Linux memory forensics tool (AVML) is made by them. Sysmon for Linux uses eBPF which makes it a tad-bit more powerful than auditd,etc.. If you can't beat'em join'em!
- hdgvhicv 1y agoI guess they managed to get rid of the foot http://mslinux.org/ http://mslinux.org/
- dotancohen 1y ago> If you can't beat'em join'em! Microsoft has a history of joining'em to beat'em. Is EEE no longer a memory?
- JdeBP 1y agoOne can browse from https://learn.microsoft.com/en-gb/linux/packages https://learn.microsoft.com/en-gb/linux/packages to see what is already there.
- darkwater 1y agoThis project is from 2020 [1]. The title should actually be updated to reflect that. Also we would have really go full circle if they used GPLv3 as the license :) [1] https://github.com/microsoft/ProcMon-for-Linux/blob/main/LICENSE https://github.com/microsoft/ProcMon-for-Linux/blob/main/LIC...
- egorfine 1y agoI remember Steve Ballmer's Microsoft well enough to know to never touch anything Microsoft for Linux. (All: feel free to downvote my neckbeard comment because I'm obviously in the wrong here)
- fennec-posix 1y agoThis feels like a TUI front-end for strace, but I'm not complaining. This I think will come in handy.
- fennec-posix 1y agoThough interestingly, seems to use its own eBPF library
- maldonad0 1y agoLooks like btop but M$.
- superkuh 1y agoThe sysinternals guys (Mark Russinovich and Bryce Cogswell) and code, at least most of it, existed independently of microsoft for many years. It was great. So great MS bought it and brought it and them inside. Russinovich is CTO of Azure now or something. So sysinternals is now random MS hires but I like to think it's still not really a microsoft product, just owned and mantained by them. I was a windows user till XP came out and I've missed sysinternals tools. I'm going to enjoy this on my newer kernel machines. Seems to require some pretty cutting edge features.
- K2h 1y agoAwesome you knew their names! I have connected with Bryce through his development of Go Map!! For open street maps.
- SonOfLilit 1y agoThey are celebs in windows security. Mark's name is synonymous with windows internals, he wrote the definitive textbook.
- xtracto 1y agoAnd he also is the one that uncovered the Sony CD rootkit fiasco. Darn I'm getting old.
- 47282847 1y agoTangent: Mark Russinovich (Jun 20, 2025): “I had the thrill of a lifetime, hosting dinner for Bill Gates, Linus Torvalds and David Cutler. Linus had never met Bill, and Dave had never met Linus.“ https://www.linkedin.com/posts/markrussinovich_i-had-the-thrill-of-a-lifetime-hosting-dinner-activity-7341857033932914691-f5Kw https://www.linkedin.com/posts/markrussinovich_i-had-the-thr...
- holowoodman 1y agoHow is this different from using 'htop' and pressing 's' to strace a process?
- noname120 1y agostrace is not available on macOS
- happymellon 1y agoI'm not sure how that is relevant on a piece about "a Linux version of a tool"
- noname120 1y agoMy bad, for some reason I thought it was about macOS rather than Linux. Procmon actually doesn’t even support macOS: https://github.com/microsoft/ProcMon-for-Linux/issues/37 https://github.com/microsoft/ProcMon-for-Linux/issues/37
- egorfine 1y agoThis is not microsofty enough. I mean it.
- INTPenis 1y agoThis is great but it's kinda sad the INSTALL.md file was updated 2 months ago and it still doesn't work. Won't anyone report these issues?
- lillecarl 1y agoI wonder why the project needs both GCC and Clang to build, usually it's one or the other.
- bena 1y agoIs it more a "collection of tools held together by a common frontend" or a unified product? If it's a collection, I can see the individual pieces needing various compilers.
- egorfine 1y agoI wonder what the goals of this project. Why does it exist?
- OlivOnTech 1y agoRequirements OS: Ubuntu 18.04 lts It's quite limited for an auditing tool...