A Linux version of the Procmon Sysinternals tool

62 LelouBil 12 8/31/2025, 10:43:05 PM github.com ↗

Comments (12)

perching_aix · 4h ago
If this works remotely as well as the Windows version, I'm stoked. Polling for information (like with lsof) really rubs me the wrong way.
0x696C6961 · 3h ago
Check out sysdig.
calvinmorrison · 4h ago
really? i have to use procman and associated utilities often and they really pale in comparison with linux and even moreso other unix utils (like dtrace)
sirjaz · 2h ago
Windows Server 2025 supports dtrace out of the box: https://learn.microsoft.com/en-us/windows-server/administrat...
lll-o-lll · 1h ago
dtrace is more comparable to ETW in windows land. Procmon is more for quick and dirty analysis. Maybe there are other *nix tools that are more appropriate, but I look forward to trying this one out.
perching_aix · 3h ago
Care to expand on that? I'm similarly just forced to use Linux and its tooling ecosystem, so decent chances I'm simply missing what's cool/cooler.
notepad0x90 · 3h ago
does this provide telemetry not available with strace?

And is the output csv/logfile compatible with the windows equivalent? If so, that'd be amazing! tools like procdot can analyze/visualize the data:

https://procdot.com/

fennec-posix · 2h ago
This feels like a TUI front-end for strace, but I'm not complaining. This I think will come in handy.
fennec-posix · 2h ago
Though interestingly, seems to use its own eBPF library
baranul · 2h ago
Expect Microsoft to come out with more Linux tools. The demand, interest, and requests are likely to only increase.
maldonad0 · 1h ago
Looks like btop but M$.
superkuh · 1h ago
The sysinternals guys (Mark Russinovich and Bryce Cogswell) and code, at least most of it, existed independently of microsoft for many years. It was great. So great MS bought it and brought it and them inside. Russinovich is CTO of Azure now or something. So sysinternals is now random MS hires but I like to think it's still not really a microsoft product, just owned and mantained by them.

I was a windows user till XP came out and I've missed sysinternals tools. I'm going to enjoy this on my newer kernel machines. Seems to require some pretty cutting edge features.