How to Install and Use Procmon on Linux, an Open Source Tool Just Released

This guide explains how to install and Use Procmon on Linux, an Open Source Tool Just Released, with clear steps, practical tips, and important checks before you begin.

What is procmon?

Perhaps many Windows users are no stranger to this tool. Procmon is a system utility that helps users easily track system calls (system calls), access the Registry and file activity related to processes running in the Supported operating systems.

Tracking these processes lets users early diagnose problems that may occur on the system, such as application conflicts, excessive resource usage, or even malware infection.

Procmon for Windows

The launch of the open source Procmon tool for Linux plays an important role, giving Linux users an additional tool to help track processes running on systems similar to Windows, as can be seen. in the demo below:

Procmon demo on Linux

How to install and build Procmon on Linux

System requirements

• Supported operating systems: Ubuntu 18.04 LTS with kernel> = 4.18 and kernel <= 5.3.
• cmake> = 3.13 (build-time only)
• libsqlite3-dev> = 3.22 (build-time only)

Install Procmon

Sign up for Microsoft key and feed:

wget -q https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb sudo dpkg -i packages-microsoft-prod.deb

Then use the following command to install Procmon:

sudo apt-get update sudo apt-get install procmon

Build Procmon from source

Install dependency:

sudo apt-get -y install bison build-essential flex git libedit-dev libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev

Build and install BCC:

git clone --branch tag_v0.10.0 https://github.com/iovisor/bcc.git mkdir bcc/build cd bcc/build cmake . -DCMAKE_INSTALL_PREFIX=/usr make sudo make install

Build Procmon:

git clone https://github.com/Microsoft/Procmon-for-Linux cd Procmon-for-Linux mkdir build cd build cmake . make

Build package Procmon:

The distribution packages for Procmon on Linux are built using cpack. To build the deb package for Procmon on Ubuntu you just need to run:

cd build cpack .

How to use Procmon

When using Procmon on Linux, users can specify the process ID they want to track or specific system calls with the following arguments:

Usage: procmon [TÙY CH?N]

There are OPTIONS including:

• -h / - help: Print this help screen
• -p / - pids: Separate the process id list with commas for monitoring
• -e / - events: Separate a list of system calls with a comma for monitoring
• -c / - collect [PATHWAY]: Option to start Procmon in non-terminal mode
• -f / - file PATHWAY : Open the trace file Procmon

For example, to monitor processes with id 738 and 2657, enter the following command:

sudo procmon -p 738,2657

To monitor PID 738 and list all read / write calls, use the following command.

sudo procmon -p 738 -e read,write

For more information about using Procmon in Linux, you can refer to the GitHub website of this project HERE: