A Linux version of the Procmon Sysinternals tool
github.com

・

163 points

・

LelouBil

・

3 days ago

48 comments

perching_aix ・ 3 days ago

If this works remotely as well as the Windows version, I'm stoked. Polling for information (like with lsof) really rubs me the wrong way.

  • calvinmorrison ・ 3 days ago

    really? i have to use procman and associated utilities often and they really pale in comparison with linux and even moreso other unix utils (like dtrace)

    • sirjaz ・ 3 days ago

      Windows Server 2025 supports dtrace out of the box: https://learn.microsoft.com/en-us/windows-server/administrat...

      • cyberpunk ・ 3 days ago
        ・ 4 more

        This really is the weirdest timeline…

        • actionfromafar ・ 2 days ago
          ・ 3 more

          But is it like the "real" dtrace or is like how PowerShell wget isn't actually wget but an alias for Invoke-WebRequest?

          • p_ing ・ 2 days ago
            ・ 2 more

            Two seconds of investigation yields that it is a port of dtrace.

            https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

            • actionfromafar ・ 2 days ago

              Well, true, but I'm not in a position to understand what that means. I remember talks about dtrace in Linux way back when and something about how "it's not the same thing, you have to add support in all of userspace which is not there" or something like that.

    • lll-o-lll ・ 3 days ago

      dtrace is more comparable to ETW in windows land. Procmon is more for quick and dirty analysis. Maybe there are other *nix tools that are more appropriate, but I look forward to trying this one out.

    • perching_aix ・ 3 days ago

      Care to expand on that? I'm similarly just forced to use Linux and its tooling ecosystem, so decent chances I'm simply missing what's cool/cooler.

      • calvinmorrison ・ 2 days ago

        yes. I work with ancient and opaque tools that dont have good debugging / reporting facilities. Often we have to jump into procmon or whatever see why the heck the thing is stuck. something like strace is native and everywhere and you can sus out easily - hey this proc is trying to open this thing over and over.

        procmon is cool, but i have found it limited when the program isnt doing anything 'obvious', and also that i have to download it and run it from the web is a problem when debugging on client systems.

notepad0x90 ・ 3 days ago

does this provide telemetry not available with strace?

And is the output csv/logfile compatible with the windows equivalent? If so, that'd be amazing! tools like procdot can analyze/visualize the data:

https://procdot.com/

  • xuhu ・ 3 days ago

    This can trace all processes on the host while strace traces one PID and its descendants. And bpf tracing does not stop processes at each syscall, so they run without slowdowns.

    • notepad0x90 ・ 2 days ago

      I think auditd can trace all syscalls system wide and let you filter as well. But it is a daemon whereas this is a tool you can run and interact with.

holowoodman ・ 3 days ago

How is this different from using 'htop' and pressing 's' to strace a process?

fennec-posix ・ 3 days ago

This feels like a TUI front-end for strace, but I'm not complaining. This I think will come in handy.

  • fennec-posix ・ 3 days ago

    Though interestingly, seems to use its own eBPF library

INTPenis ・ 3 days ago

This is great but it's kinda sad the INSTALL.md file was updated 2 months ago and it still doesn't work. Won't anyone report these issues?

  • GTP ・ 3 days ago

    Go on and be the one that reports it ;)

    • INTPenis ・ 3 days ago

      I will as soon as I get home from work lol.

carlhjerpe ・ 3 days ago

I wonder why the project needs both GCC and Clang to build, usually it's one or the other.

  • bena ・ 3 days ago

    Is it more a "collection of tools held together by a common frontend" or a unified product?

    If it's a collection, I can see the individual pieces needing various compilers.

egorfine ・ 3 days ago

I wonder what the goals of this project. Why does it exist?

baranul ・ 3 days ago

Expect Microsoft to come out with more Linux tools. The demand, interest, and requests are likely to only increase.

  • notepad0x90 ・ 3 days ago

    They have one of the largest Linux user base out there in Azure. They have their own distro. My favorite Linux memory forensics tool (AVML) is made by them. Sysmon for Linux uses eBPF which makes it a tad-bit more powerful than auditd,etc..

    If you can't beat'em join'em!

    • dotancohen ・ 2 days ago 

        > If you can't beat'em join'em!
      Microsoft has a history of joining'em to beat'em. Is EEE no longer a memory?
  • egorfine ・ 3 days ago

    I remember Steve Ballmer's Microsoft well enough to know to never touch anything Microsoft for Linux.

    (All: feel free to downvote my neckbeard comment because I'm obviously in the wrong here)

    • spauldo ・ 2 days ago

      Yep, right there with you.

OlivOnTech ・ 2 days ago

Requirements OS: Ubuntu 18.04 lts

It's quite limited for an auditing tool...

maldonad0 ・ 3 days ago

Looks like btop but M$.

  • superkuh ・ 3 days ago

    The sysinternals guys (Mark Russinovich and Bryce Cogswell) and code, at least most of it, existed independently of microsoft for many years. It was great. So great MS bought it and brought it and them inside. Russinovich is CTO of Azure now or something. So sysinternals is now random MS hires but I like to think it's still not really a microsoft product, just owned and mantained by them.

    I was a windows user till XP came out and I've missed sysinternals tools. I'm going to enjoy this on my newer kernel machines. Seems to require some pretty cutting edge features.

    • egorfine ・ 3 days ago

      It was truly great for Windows, no doubt about that.

      Now, is it great for Linux? Absolutely not. These tools existed to vaguely resemble the capabilities we have had on *nix for decades and I'm not sure what kind of value could they bring back to Linux... like, really, what? A different, Microsoft-style optics to look at processes?

    • K2h ・ 3 days ago

      Awesome you knew their names! I have connected with Bryce through his development of Go Map!! For open street maps.

      • SonOfLilit ・ 3 days ago
        ・ 2 more

        They are celebs in windows security. Mark's name is synonymous with windows internals, he wrote the definitive textbook.

        • xtracto ・ 3 days ago

          And he also is the one that uncovered the Sony CD rootkit fiasco.

          Darn I'm getting old.