Filtering of processes is optionally done on command name, ranging from absolute to fuzzy. This week Microsoft has released a Linux version of the popular Procmon utility that Linux users can monitor running processes.Ībove all, this application scans the table of running processes, killing those that has exceeds a given CPU-time limit or has gone for lunch. There are a couple of examples on this site: tracking file accesses, tracking process execution.Procmon is a Windows utility that monitors the system calls, Registry access, and file activity for processes running in the operating system. It's relatively recent and there's not much literature on the topic search for auditctl or read the auditctl man page. To watch all the system calls under Linux, you can use the audit subsystem. kqueue under *BSD, and FAM (originally from SGI but now available as an API on many systems). Īgain, the facility is specific to Linux, but most other unices have a similar system, e.g. To watch what's happening to a particular file or in a particular directory or directory tree, use the inotify facility. Strace is specific to Linux, but other systems have a similar tool: truss on Solaris, ktrace or dtrace under *BSD, etc.

Strace -s9999 -efile -p1234 # trace a running program with the given PID For example, if you're only interested in filesystem accesses: strace -s9999 -efile command_name # trace a program during its whole execution To watch what a particular process is doing, call strace on it. If you want more detailed information, it's not tracked by default. For example, there's iotop to watch disk I/O, atop for a bunch of system resources, powertop for power consumption. The grandaddy of all process monitors is top, and many system monitoring tools are called top.

Procmon linux