microsoft/ProcMon-for-Linux
ProcMon For Linux
ProcMon-for-Linux es una herramienta de observabilidad del sistema basada en eBPF y monitor de procesos para Linux. Funciona como un rastreador de llamadas al sistema y registrador de actividad, capturando eventos del kernel y del espacio de usuario en tiempo real para analizar el comportamiento del sistema operativo.
El proyecto cuenta con una interfaz de usuario de texto para inspeccionar archivos de traza grabados. Separa la grabación de eventos headless de alto rendimiento de la interfaz de análisis para prevenir la pérdida de datos durante cargas pesadas del sistema.
La herramienta proporciona capacidades para el rastreo de llamadas al sistema y monitoreo de actividad, incluyendo la capacidad de filtrar eventos por identificadores de proceso o tipos de llamadas al sistema específicos. Soporta la depuración de procesos de bajo nivel y el análisis retrospectivo de la actividad del sistema.
Features
- System Call Tracing - Provides real-time monitoring of Linux system calls to debug software behavior and identify failures.
- eBPF Event Captures - Provides high-performance event capture using eBPF bytecode executed within the Linux kernel.
- TUI Trace Viewers - Provides a text user interface for opening and inspecting recorded trace files to analyze system activity.
- Linux - Monitors Linux process events and file system activity to analyze operating system behavior.
- System Call Monitors - Tracks real-time file system and process events to provide deep visibility into Linux system behavior.
- System Activity Monitoring - Tracks real-time file system, registry, and process events for visibility into OS behavior.
- eBPF-Based Activity Monitors - Utilizes eBPF to capture high-performance traces of kernel and user-space activity for system observability.
- Event Trace Analyzers - Provides a terminal user interface for opening and inspecting recorded trace files of system activity.
- Trace Analysis Interfaces - Ships a text-based user interface for inspecting and filtering recorded system activity files.
- Kernel Ring Buffer Retrieval - Implements high-performance data transfer from the kernel to userspace using ring buffers.
- SQLite Storage Adapters - Uses a local SQLite database for persistent storage and efficient querying of captured trace data.
- Low-Level Debuggers - Enables low-level analysis of interactions between software and the Linux kernel to identify bottlenecks.
- System Event Recorders - Records system-generated actions and events for retrospective diagnosis of intermittent execution issues.
- Headless Recorders - Separates high-performance headless event recording from the analysis interface to prevent data loss.
- Selective Event Filtering - Allows restricting traced activity to specific process IDs or syscall types to reduce noise during capture.
- Syscall Filtering - Applies kernel-level predicates to filter syscalls and reduce noise during event capture.
