Microsoft Brings procmon to Linux

The Microsoft process monitor tool has arrived for Linux. Process Monitor (otherwise known as procmon), is a reimagined version of the tool for Linux. For those that have worked with procmon, you know it’s a convenient tool to view real-time file system activity. And for developers, procmon makes it easy to trace syscall activity on a given system. Procmon also supports logging information to file (so you can analyze data at a later time), is highly configurable, supports non-destructive filters, capturing thread stacks and process details, and boot logging.

Although the addition of procmon to Linux might not be terribly exciting to the average Linux desktop user, for developers, procmon could be a serious game changer.

At the moment, procmon is limited to Ubuntu 18.04 systems running a kernel between release 4.18 and 5.3. You will also need cmake greater than or equal to 3.1 and libsqlite3-dev greater than or equal to 3.22. Microsoft plans on adding more configurations in later builds, so look for procmon to be available to a wider range of distributions soon.

To find out exactly how to build procmon on the supported systems, head over to the official GitHub page for the project.