Procmon-for-Linux is a Linux port of Microsoft's Sysinternals Process Monitor. It captures and displays system call events in real-time using eBPF raw tracepoints. The architecture is a modular C++17 application with four layers: tracer (eBPF-based), storage (SQLite), display (ncurses TUI or headless), and configuration/CLI. The main entry point is src/procmon.cpp which initializes the eBPF programs, parses command-line arguments, and runs either an interactive terminal UI or a headless collection mode. Data flows from kernel eBPF programs to a user-space consumer via a cancellable message queue, then into an SQLite in-memory database, and finally to the display layer. The application supports filtering, sorting, searching, and exporting events. It depends on the SysinternalsEBPF library for eBPF loading, libncursesw6 for UI, libelf for symbol resolution, and SQLite3 for storage. The eBPF kernel modules are version-specific and support Linux kernels 4.17 through 5.6+. The project includes mock engines for testing and builds packages for Debian and RPM-based distributions. The codebase demonstrates strong software engineering practices: clear separation of concerns, use of design patterns (factory, strategy, observer via queues), thread-safe event handling, and comprehensive testing with Catch2. However, it has some technical drift risks due to reliance on specific kernel versions, an older version of Easylogging++, and a custom SysinternalsEBPF library that may change. The build process is well-documented with dev containers and CI pipelines.