A Linux version of the Procmon Sysinternals tool

https://github.com/microsoft/ProcMon-for-Linux

166•LelouBil•5mo ago

Comments

perching_aix•5mo ago

If this works remotely as well as the Windows version, I'm stoked. Polling for information (like with lsof) really rubs me the wrong way.

calvinmorrison•5mo ago

really? i have to use procman and associated utilities often and they really pale in comparison with linux and even moreso other unix utils (like dtrace)

perching_aix•5mo ago

Care to expand on that? I'm similarly just forced to use Linux and its tooling ecosystem, so decent chances I'm simply missing what's cool/cooler.

calvinmorrison•5mo ago

yes. I work with ancient and opaque tools that dont have good debugging / reporting facilities. Often we have to jump into procmon or whatever see why the heck the thing is stuck. something like strace is native and everywhere and you can sus out easily - hey this proc is trying to open this thing over and over.

procmon is cool, but i have found it limited when the program isnt doing anything 'obvious', and also that i have to download it and run it from the web is a problem when debugging on client systems.

sirjaz•5mo ago

Windows Server 2025 supports dtrace out of the box: https://learn.microsoft.com/en-us/windows-server/administrat...

cyberpunk•5mo ago

This really is the weirdest timeline…

actionfromafar•5mo ago

But is it like the "real" dtrace or is like how PowerShell wget isn't actually wget but an alias for Invoke-WebRequest?

p_ing•5mo ago

Two seconds of investigation yields that it is a port of dtrace.

https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

actionfromafar•5mo ago

Well, true, but I'm not in a position to understand what that means. I remember talks about dtrace in Linux way back when and something about how "it's not the same thing, you have to add support in all of userspace which is not there" or something like that.

lll-o-lll•5mo ago

dtrace is more comparable to ETW in windows land. Procmon is more for quick and dirty analysis. Maybe there are other *nix tools that are more appropriate, but I look forward to trying this one out.

TiredOfLife•5mo ago

really? One of the things I miss when using linux is resmon. I have not found anything that has even remotely the same functionality. For example seeing which process is using which files.

olddustytrail•5mo ago

You can do that with sysdig.

bdhcuidbebe•5mo ago

There’s multiple tools.

For your stated issue, see lsfd

https://www.man7.org/linux/man-pages/man1/lsfd.1.html

0x696C6961•5mo ago

Check out sysdig.

notepad0x90•5mo ago

does this provide telemetry not available with strace?

And is the output csv/logfile compatible with the windows equivalent? If so, that'd be amazing! tools like procdot can analyze/visualize the data:

https://procdot.com/

xuhu•5mo ago

This can trace all processes on the host while strace traces one PID and its descendants. And bpf tracing does not stop processes at each syscall, so they run without slowdowns.

notepad0x90•5mo ago

I think auditd can trace all syscalls system wide and let you filter as well. But it is a daemon whereas this is a tool you can run and interact with.

baranul•5mo ago

Expect Microsoft to come out with more Linux tools. The demand, interest, and requests are likely to only increase.

notepad0x90•5mo ago

They have one of the largest Linux user base out there in Azure. They have their own distro. My favorite Linux memory forensics tool (AVML) is made by them. Sysmon for Linux uses eBPF which makes it a tad-bit more powerful than auditd,etc..

If you can't beat'em join'em!

hdgvhicv•5mo ago

I guess they managed to get rid of the foot

http://mslinux.org/

dotancohen•5mo ago

  > If you can't beat'em join'em!

Microsoft has a history of joining'em to beat'em. Is EEE no longer a memory?

JdeBP•5mo ago

One can browse from https://learn.microsoft.com/en-gb/linux/packages to see what is already there.

darkwater•5mo ago

This project is from 2020 [1]. The title should actually be updated to reflect that. Also we would have really go full circle if they used GPLv3 as the license :)

[1] https://github.com/microsoft/ProcMon-for-Linux/blob/main/LIC...

egorfine•5mo ago

I remember Steve Ballmer's Microsoft well enough to know to never touch anything Microsoft for Linux.

(All: feel free to downvote my neckbeard comment because I'm obviously in the wrong here)

spauldo•5mo ago

Yep, right there with you.

fennec-posix•5mo ago

This feels like a TUI front-end for strace, but I'm not complaining. This I think will come in handy.

fennec-posix•5mo ago

Though interestingly, seems to use its own eBPF library

maldonad0•5mo ago

Looks like btop but M$.

superkuh•5mo ago

The sysinternals guys (Mark Russinovich and Bryce Cogswell) and code, at least most of it, existed independently of microsoft for many years. It was great. So great MS bought it and brought it and them inside. Russinovich is CTO of Azure now or something. So sysinternals is now random MS hires but I like to think it's still not really a microsoft product, just owned and mantained by them.

I was a windows user till XP came out and I've missed sysinternals tools. I'm going to enjoy this on my newer kernel machines. Seems to require some pretty cutting edge features.

K2h•5mo ago

Awesome you knew their names! I have connected with Bryce through his development of Go Map!! For open street maps.

SonOfLilit•5mo ago

They are celebs in windows security. Mark's name is synonymous with windows internals, he wrote the definitive textbook.

xtracto•5mo ago

And he also is the one that uncovered the Sony CD rootkit fiasco.

Darn I'm getting old.

47282847•5mo ago

Tangent: Mark Russinovich (Jun 20, 2025): “I had the thrill of a lifetime, hosting dinner for Bill Gates, Linus Torvalds and David Cutler. Linus had never met Bill, and Dave had never met Linus.“

https://www.linkedin.com/posts/markrussinovich_i-had-the-thr...

dotancohen•5mo ago

The phrasing implies that meeting someone is not bi-directional.

egorfine•5mo ago

It was truly great for Windows, no doubt about that.

Now, is it great for Linux? Absolutely not. These tools existed to vaguely resemble the capabilities we have had on *nix for decades and I'm not sure what kind of value could they bring back to Linux... like, really, what? A different, Microsoft-style optics to look at processes?

INTPenis•5mo ago

This is great but it's kinda sad the INSTALL.md file was updated 2 months ago and it still doesn't work. Won't anyone report these issues?

GTP•5mo ago

Go on and be the one that reports it ;)

INTPenis•5mo ago

I will as soon as I get home from work lol.

holowoodman•5mo ago

How is this different from using 'htop' and pressing 's' to strace a process?

noname120•5mo ago

strace is not available on macOS

happymellon•5mo ago

I'm not sure how that is relevant on a piece about "a Linux version of a tool"

noname120•5mo ago

My bad, for some reason I thought it was about macOS rather than Linux. Procmon actually doesn’t even support macOS: https://github.com/microsoft/ProcMon-for-Linux/issues/37

egorfine•5mo ago

This is not microsofty enough.

I mean it.

lillecarl•5mo ago

I wonder why the project needs both GCC and Clang to build, usually it's one or the other.

bena•5mo ago

Is it more a "collection of tools held together by a common frontend" or a unified product?

If it's a collection, I can see the individual pieces needing various compilers.

egorfine•5mo ago

I wonder what the goals of this project. Why does it exist?

OlivOnTech•5mo ago

Requirements OS: Ubuntu 18.04 lts

It's quite limited for an auditing tool...

Creating and Hosting a Static Website on Cloudflare for Free

"The Stanford scam proves America is becoming a nation of grifters"

Elon Musk on Space GPUs, AI, Optimus, and His Manufacturing Method

X (Twitter) is back with a new X API Pay-Per-Use model

Zlob.h 100% POSIX and glibc compatible globbing lib that is faste and better

Show HN: Deterministic signal triangulation using a fixed .72% variance constant

Scientists Discover Levitating Time Crystals You Can Hold, Defy Newton’s 3rd Law

When Michelangelo Met Titian

Solving NYT Pips with DLX

Baldur's Gate to be turned into TV series – without the game's developers

Interview with 'Just use a VPS' bro (OpenClaw version) [video]

EchoJEPA: Latent Predictive Foundation Model for Echocardiography

Disablling Go Telemetry

Effective Nihilism

The UK government didn't want you to see this report on ecosystem collapse

No 10 blocks report on impact of rainforest collapse on food prices

Seedance 2.0 Is Coming

Show HN: Fitspire – a simple 5-minute workout app for busy people (iOS)

Dexterous robotic hands: 2009 – 2014 – 2025

Interop 2025: A Year of Convergence

JobArena – Human Intuition vs. Artificial Intelligence

Concept Artists Say Generative AI References Only Make Their Jobs Harder

Show HN: PaySentry – Open-source control plane for AI agent payments

Show HN: Moli P2P – An ephemeral, serverless image gallery (Rust and WebRTC)

The Crumbling Workflow Moat: Aggregation Theory's Final Chapter

Pax Historia – User and AI powered gaming platform

Show HN: I built a RAG engine to search Singaporean laws

Scams, Fraud, and Fake Apps: How to Protect Your Money in a Mobile-First Economy

Porting Doom to My WebAssembly VM

Cognitive Style and Visual Attention in Multimodal Museum Exhibitions

Creating and Hosting a Static Website on Cloudflare for Free

"The Stanford scam proves America is becoming a nation of grifters"

Elon Musk on Space GPUs, AI, Optimus, and His Manufacturing Method

X (Twitter) is back with a new X API Pay-Per-Use model

Zlob.h 100% POSIX and glibc compatible globbing lib that is faste and better

Show HN: Deterministic signal triangulation using a fixed .72% variance constant

Scientists Discover Levitating Time Crystals You Can Hold, Defy Newton’s 3rd Law

When Michelangelo Met Titian

Solving NYT Pips with DLX

Baldur's Gate to be turned into TV series – without the game's developers

Interview with 'Just use a VPS' bro (OpenClaw version) [video]

EchoJEPA: Latent Predictive Foundation Model for Echocardiography

Disablling Go Telemetry

Effective Nihilism

The UK government didn't want you to see this report on ecosystem collapse

No 10 blocks report on impact of rainforest collapse on food prices

Seedance 2.0 Is Coming

Show HN: Fitspire – a simple 5-minute workout app for busy people (iOS)

Dexterous robotic hands: 2009 – 2014 – 2025

Interop 2025: A Year of Convergence

JobArena – Human Intuition vs. Artificial Intelligence

Concept Artists Say Generative AI References Only Make Their Jobs Harder

Show HN: PaySentry – Open-source control plane for AI agent payments

Show HN: Moli P2P – An ephemeral, serverless image gallery (Rust and WebRTC)

The Crumbling Workflow Moat: Aggregation Theory's Final Chapter

Pax Historia – User and AI powered gaming platform

Show HN: I built a RAG engine to search Singaporean laws

Scams, Fraud, and Fake Apps: How to Protect Your Money in a Mobile-First Economy

Porting Doom to My WebAssembly VM

Cognitive Style and Visual Attention in Multimodal Museum Exhibitions

A Linux version of the Procmon Sysinternals tool

Comments