Microsoft releases Process Monitor tool Procmon for Linux

[harlan4096]

Microsoft revealed some time ago that it had plans to port some of the tools provided by Sysinternals to Linux. One of the tools mentioned was Process Monitor, or short ProcMon, and a preview of the application is now available for Linux.

Process Monitor is an advanced monitoring tool for Windows that displays real-time data such as Registry, process and thread activity. It is a powerful tool that supports logging the information to files for later analysis.

The program is highly configurable, supports non-destructive filters, the capturing of thread stacks, process details capturing, and boot time logging of operations.

The Linux version of Procmon is now available on GitHub. The open source tool has been released as a preview.

Since it is released as a preview, it is limited to systems running Ubuntu 18.04 with kernel 4.18 up to 5.3 at the time of writing. Several users tried to build or install the process monitor tool on Ubuntu 20.04 systems and failed.

Microsoft plans to add more configurations to the system requirements in the future to take these systems into account.

Installation instructions on Ubuntu 18.04 devices are straightforward. Run the following commands:

1. wget -q https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
   sudo dpkg -i packages-microsoft-prod.deb
   
2. sudo apt-get update
   
3. sudo apt-get install procmon
   

Build instructions are provided as well on the project's GitHub website, and Linux users may download a .deb file from the releases section on the project's GitHub page.

You may run procmon -h after installation to display the help screen. Here are a few example commands that you may run:

• sudo procmon // runs the process monitor tool to trace all processes and syscalls.
  
• sudo procmon -p 1337 -c procmon.db // traces the process 1337 in headless mode and saves the data to the file procmon.db
  
• sudo procmon -p 1337 -e read,write,openat // traces syscalls read, write, and opennat of process 1337
  
• sudo procmon -f procmon.db // opens the trace file procmon.db within the interface.
  

Closing Words

Procmon is a powerful system monitoring tool for advanced uses. The Linux version comes without the help file that the Windows version of Procmon includes. Since it is offered as a preview, it is possible that a help file will be provided once the program is offered as a stable release.
...

Continue Reading