microsoft/ProcMon-for-Linux
ProcMon For Linux
ProcMon-for-Linux est un outil d'observabilité système basé sur eBPF et un moniteur de processus pour Linux. Il fonctionne comme un traceur d'appels système et un journal d'activité, capturant les événements du noyau et de l'espace utilisateur en temps réel pour analyser le comportement du système d'exploitation.
Le projet dispose d'une interface utilisateur textuelle pour inspecter les fichiers de trace enregistrés. Il sépare l'enregistrement d'événements haute performance sans interface de l'interface d'analyse pour éviter la perte de données lors de lourdes charges système.
L'outil fournit des capacités de traçage d'appels système et de surveillance d'activité, incluant la possibilité de filtrer les événements par identifiants de processus ou types d'appels système spécifiques. Il prend en charge le débogage de processus bas niveau et l'analyse rétrospective de l'activité système.
Features
- System Call Tracing - Provides real-time monitoring of Linux system calls to debug software behavior and identify failures.
- eBPF Event Captures - Provides high-performance event capture using eBPF bytecode executed within the Linux kernel.
- TUI Trace Viewers - Provides a text user interface for opening and inspecting recorded trace files to analyze system activity.
- Linux - Monitors Linux process events and file system activity to analyze operating system behavior.
- System Call Monitors - Tracks real-time file system and process events to provide deep visibility into Linux system behavior.
- System Activity Monitoring - Tracks real-time file system, registry, and process events for visibility into OS behavior.
- eBPF-Based Activity Monitors - Utilizes eBPF to capture high-performance traces of kernel and user-space activity for system observability.
- Event Trace Analyzers - Provides a terminal user interface for opening and inspecting recorded trace files of system activity.
- Trace Analysis Interfaces - Ships a text-based user interface for inspecting and filtering recorded system activity files.
- Kernel Ring Buffer Retrieval - Implements high-performance data transfer from the kernel to userspace using ring buffers.
- SQLite Storage Adapters - Uses a local SQLite database for persistent storage and efficient querying of captured trace data.
- Low-Level Debuggers - Enables low-level analysis of interactions between software and the Linux kernel to identify bottlenecks.
- System Event Recorders - Records system-generated actions and events for retrospective diagnosis of intermittent execution issues.
- Headless Recorders - Separates high-performance headless event recording from the analysis interface to prevent data loss.
- Selective Event Filtering - Allows restricting traced activity to specific process IDs or syscall types to reduce noise during capture.
- Syscall Filtering - Applies kernel-level predicates to filter syscalls and reduce noise during event capture.
