2 Star 9 Fork 1

Gitee 极速下载 / procmon-for-linux

Create your Gitee Account
Explore and code with more than 6 million developers,Free private repositories !:)
Sign up
此仓库是为了提升国内下载速度的镜像仓库,每日同步一次。 原始仓库: https://github.com/microsoft/ProcMon-for-Linux
Clone or download
Cancel
Notice: Creating folder will generate an empty file .keep, because not support in Git
Loading...
README.md

Process Monitor for Linux (Preview) Build Status

Process Monitor (Procmon) is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system.

Procmon in use

Installation & Usage

Requirements

  • OS: Ubuntu 18.04 lts with kernel >= 4.18 and kernel <= 5.3
  • cmake >= 3.14 (build-time only)
  • libsqlite3-dev >= 3.22 (build-time only)

Install Procmon

Checkout our install instructions for distribution specific steps to install Procmon.

Building Procmon from source

1. Install build dependencies

sudo apt-get -y install bison build-essential flex git libedit-dev \
  libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev

2. Build and install BCC

git clone --branch tag_v0.10.0 https://github.com/iovisor/bcc.git
mkdir bcc/build
cd bcc/build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr
make
sudo make install

3. Build Procmon

git clone https://github.com/Microsoft/Procmon-for-Linux
cd Procmon-for-Linux
mkdir build
cd build
cmake ..
make

Building Procmon Packages

The distribution packages for Procmon for Linux are constructed utilizing cpack.

To build a deb package of Procmon on Ubuntu simply run:

cd build
cpack ..

Usage

Usage: procmon [OPTIONS]
   OPTIONS
      -h/--help                Prints this help screen
      -p/--pids                Comma separated list of process ids to monitor
      -e/--events              Comma separated list of system calls to monitor
      -c/--collect [FILEPATH]  Option to start Procmon in a headless mode
      -f/--file FILEPATH       Open a Procmon trace file

Examples

The following traces all processes and syscalls on the system

sudo procmon

The following traces processes with process id 10 and 20

sudo procmon -p 10,20

The following traces process 20 only syscalls read, write and openat

sudo procmon -p 20 -e read,write,openat

The following traces process 35 and opens Procmon in headless mode to output all captured events to file procmon.db

sudo procmon -p 35 -c procmon.db

The following opens a Procmon tracefile, procmon.db, within the Procmon TUI

sudo procmon -f procmon.db

Feedback

  • Ask a question on StackOverflow (tag with ProcmonForLinux)
  • Request a new feature on GitHub
  • Vote for popular feature requests
  • File a bug in GitHub Issues

Contributing

If you are interested in fixing issues and contributing directly to the code base, please see the document How to Contribute, which covers the following:

  • How to build and run from source
  • The development workflow, including debugging and running tests
  • Coding Guidelines
  • Submitting pull requests

Please see also our Code of Conduct.

License

Copyright (c) Microsoft Corporation. All rights reserved.

Licensed under the MIT License.

Comments ( 0 )

Sign in for post a comment

About

Windows 经典进程监控工具 Procmon 的 Linux 版本 spread retract
Cancel

Releases

No release

Contributors

All

Activities

load more
can not load any more
C/C++
1
https://gitee.com/mirrors/procmon-for-linux.git
git@gitee.com:mirrors/procmon-for-linux.git
mirrors
procmon-for-linux
procmon-for-linux
main

Search