microsoft/ProcMon-for-Linux
ProcMon For Linux
ProcMon-for-Linux 是一个基于 eBPF 的 Linux 系统可观测性工具和进程监视器。它作为系统调用跟踪器和活动记录器，捕获实时的内核和用户空间事件，以分析操作系统行为。
该项目具有用于检查记录跟踪文件的文本用户界面。它将高性能的无头事件记录与分析界面分离，以防止在系统高负载期间发生数据丢失。
该工具提供系统调用跟踪和活动监控功能，包括按进程标识符或特定系统调用类型过滤事件的能力。它支持底层进程调试和系统活动的回溯分析。
Features
- System Call Tracing - Provides real-time monitoring of Linux system calls to debug software behavior and identify failures.
- eBPF Event Captures - Provides high-performance event capture using eBPF bytecode executed within the Linux kernel.
- TUI Trace Viewers - Provides a text user interface for opening and inspecting recorded trace files to analyze system activity.
- Linux - Monitors Linux process events and file system activity to analyze operating system behavior.
- System Call Monitors - Tracks real-time file system and process events to provide deep visibility into Linux system behavior.
- System Activity Monitoring - Tracks real-time file system, registry, and process events for visibility into OS behavior.
- eBPF-Based Activity Monitors - Utilizes eBPF to capture high-performance traces of kernel and user-space activity for system observability.
- Event Trace Analyzers - Provides a terminal user interface for opening and inspecting recorded trace files of system activity.
- Trace Analysis Interfaces - Ships a text-based user interface for inspecting and filtering recorded system activity files.
- Kernel Ring Buffer Retrieval - Implements high-performance data transfer from the kernel to userspace using ring buffers.
- SQLite Storage Adapters - Uses a local SQLite database for persistent storage and efficient querying of captured trace data.
- Low-Level Debuggers - Enables low-level analysis of interactions between software and the Linux kernel to identify bottlenecks.
- System Event Recorders - Records system-generated actions and events for retrospective diagnosis of intermittent execution issues.
- Headless Recorders - Separates high-performance headless event recording from the analysis interface to prevent data loss.
- Selective Event Filtering - Allows restricting traced activity to specific process IDs or syscall types to reduce noise during capture.
- Syscall Filtering - Applies kernel-level predicates to filter syscalls and reduce noise during event capture.
