awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
microsoft avatar

microsoft/ProcMon-for-Linux

0
View on GitHub↗

ProcMon For Linux

ProcMon-for-Linux is an eBPF-based system observability tool and process monitor for Linux. It functions as a system call tracer and activity logger, capturing real-time kernel and user-space events to analyze operating system behavior.

The project features a text user interface for inspecting recorded trace files. It separates high-performance headless event recording from the analysis interface to prevent data loss during heavy system loads.

The tool provides capabilities for system call tracing and activity monitoring, including the ability to filter events by process identifiers or specific system call types. It supports low-level process debugging and the retrospective analysis of system activity.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • System Call Tracing - Provides real-time monitoring of Linux system calls to debug software behavior and identify failures.
  • eBPF Event Captures - Provides high-performance event capture using eBPF bytecode executed within the Linux kernel.
  • TUI Trace Viewers - Provides a text user interface for opening and inspecting recorded trace files to analyze system activity.
  • Linux - Monitors Linux process events and file system activity to analyze operating system behavior.
  • System Call Monitors - Tracks real-time file system and process events to provide deep visibility into Linux system behavior.
  • System Activity Monitoring - Tracks real-time file system, registry, and process events for visibility into OS behavior.
  • eBPF-Based Activity Monitors - Utilizes eBPF to capture high-performance traces of kernel and user-space activity for system observability.
  • Event Trace Analyzers - Provides a terminal user interface for opening and inspecting recorded trace files of system activity.
  • Trace Analysis Interfaces - Ships a text-based user interface for inspecting and filtering recorded system activity files.
  • Kernel Ring Buffer Retrieval - Implements high-performance data transfer from the kernel to userspace using ring buffers.
  • SQLite Storage Adapters - Uses a local SQLite database for persistent storage and efficient querying of captured trace data.
  • Low-Level Debuggers - Enables low-level analysis of interactions between software and the Linux kernel to identify bottlenecks.
  • System Event Recorders - Records system-generated actions and events for retrospective diagnosis of intermittent execution issues.
  • Headless Recorders - Separates high-performance headless event recording from the analysis interface to prevent data loss.
  • Selective Event Filtering - Allows restricting traced activity to specific process IDs or syscall types to reduce noise during capture.
  • Syscall Filtering - Applies kernel-level predicates to filter syscalls and reduce noise during event capture.
4,695 stars·289 forks·C·MIT·16 views

Star history

Star history chart for microsoft/procmon-for-linuxStar history chart for microsoft/procmon-for-linux

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does microsoft/procmon-for-linux do?

ProcMon-for-Linux is an eBPF-based system observability tool and process monitor for Linux. It functions as a system call tracer and activity logger, capturing real-time kernel and user-space events to analyze operating system behavior.

What are the main features of microsoft/procmon-for-linux?

The main features of microsoft/procmon-for-linux are: System Call Tracing, eBPF Event Captures, TUI Trace Viewers, Linux, System Call Monitors, System Activity Monitoring, eBPF-Based Activity Monitors, Event Trace Analyzers.

Which projects share features with microsoft/procmon-for-linux?

Projects with overlapping indexed features include: cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.… iovisor/bcc — BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It… missing-semester/missing-semester — The Missing Semester is a free, open-source educational curriculum designed to bridge the gap between theoretical… aquasecurity/tracee — Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events… comodosecurity/openedr — OpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to… orhun/binsider — Binsider is a collection of specialized toolsets for hexadecimal editing, ELF structural analysis, system call…

Projects sharing features with ProcMon For Linux

These projects share indexed features with ProcMon For Linux. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • iovisor/bcciovisor avatar

    iovisor/bcc

    22,459View on GitHub↗

    BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

    C
    View on GitHub↗22,459
  • missing-semester/missing-semestermissing-semester avatar

    missing-semester/missing-semester

    5,525View on GitHub↗

    The Missing Semester is a free, open-source educational curriculum designed to bridge the gap between theoretical computer science and the practical tooling every software engineer needs. Organized as a structured course, it covers Unix shell mastery, version control with Git, software debugging and profiling, system administration fundamentals, and computer security practices — the skills often left out of traditional degree programs. The project is maintained as a collaborative set of lecture notes, exercises, and guides that function as both a professional development tools course and a Uni

    CSS
    View on GitHub↗5,525
  • cilium/tetragoncilium avatar

    cilium/tetragon

    4,753View on GitHub↗

    Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

    C
    View on GitHub↗4,753
  • comodosecurity/openedrComodoSecurity avatar

    ComodoSecurity/openedr

    2,603View on GitHub↗

    OpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to identify security breaches. It functions as a host-based intrusion detection system and telemetry collector, gathering detailed data on process, network, and file activity. The system includes a dockerized security stack that bundles search, logging, and visualization tools into containers for analyzing endpoint telemetry. It features a security event visualizer that maps process lineage and indexes logs to facilitate root-cause analysis of attacks. The platform provides capabi

    C++
    View on GitHub↗2,603
    • Compare all 30 related projects→