What is procmon-for-linux?

microsoft/procmon-for-linux — explained in plain English

Analysis updated 2026-06-26

★ 4,675CAudience · developerComplexity · 3/5LicenseSetup · moderate

Mindmap

mindmap
  root((Procmon Linux))
    What it does
      Tracks system calls
      Monitors file access
      Watches network calls
    How to Use
      Run as admin
      Filter by process ID
      Save to database
    Modes
      Live interactive view
      Headless server mode
    Origins
      Port from Windows
      Open source MIT

mindmap root((Procmon Linux)) What it does Tracks system calls Monitors file access Watches network calls How to Use Run as admin Filter by process ID Save to database Modes Live interactive view Headless server mode Origins Port from Windows Open source MIT

Click or tap to explore — scroll the page freely

What do people build with it?

USE CASE 1

Debug a misbehaving Linux program by recording every file read, write, and network connection it makes.

USE CASE 2

Monitor suspicious processes for security analysis by capturing all their system calls in real time.

USE CASE 3

Save a capture session to disk and review it later to diagnose intermittent or hard-to-reproduce issues.

USE CASE 4

Run headless on a Linux server to capture system call events to a file for offline analysis without a display.

What is it built with?

CLinuxUbuntu

How does it compare?

	microsoft/procmon-for-linux	session-replay-tools/tcpcopy	cilium/tetragon
Stars	4,675	4,679	4,662
Language	C	C	C
Setup difficulty	moderate	hard	hard
Complexity	3/5	4/5	4/5
Audience	developer	ops devops	ops devops

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · moderate Time to first run · 30min

Requires administrator (root) privileges to run and access system call information.

Use freely for any purpose including commercial, just keep the copyright notice.

So what is it?

Process Monitor for Linux is a Microsoft tool that watches what programs on a Linux computer are doing at a low level. Specifically, it tracks system calls, which are the requests a program sends to the operating system when it wants to read a file, write data, open a network connection, or do almost anything that involves the underlying machine. By recording these calls, you can see exactly what a program is up to while it runs. The tool is a Linux port of a well-known Windows utility called Procmon, which has been used by Windows developers and security researchers for many years. This version brings the same idea to Ubuntu Linux. You run it with administrator privileges, and it shows you a live stream of activity. You can narrow the view to specific processes by their ID numbers, or filter to only certain types of system calls. Results can be saved to a database file on disk and reviewed later using the same tool. There is also a headless mode for running on servers where there is no screen, writing captured events straight to a file without an interactive display. Installation instructions and build steps are in separate files linked from the README. The project is open source under the MIT license and welcomes bug reports and feature requests through GitHub.

Copy-paste prompts

Prompt 1

Use Process Monitor for Linux to trace what files and network connections my Python web server opens during startup.

Prompt 2

How do I filter Process Monitor for Linux output to show only file system calls from a specific process ID?

Prompt 3

Write a script that runs procmon-for-linux in headless mode for 60 seconds, saves the output, then summarizes the most-accessed files.

Prompt 4

Help me use procmon-for-linux to find out why my application is failing silently by tracing its system calls.

Prompt 5

How do I build Process Monitor for Linux from source on Ubuntu and run it with the required administrator privileges?

Frequently asked questions