$ show microsoft/ProcMon-for-Linux
Procmon-for-Linux is a Linux port of Microsoft's Sysinternals Process Monitor. It captures and displays system call events in real-time using eBPF raw tracepoints. The architecture is a modular C++17 application with four layers: tracer (eBPF-based), storage (SQLite), display (ncurses TUI or headless), and configuration/CLI. The main entry point is src/procmon.cpp which initializes the eBPF programs, parses command-line arguments, and runs either an interactive terminal UI or a headless collection mode. Data flows from kernel eBPF programs to a user-space consumer via a cancellable message queue, then into an SQLite in-memory database, and finally to the display layer. The application supports filtering, sorting, searching, and exporting events. It depends on the SysinternalsEBPF library for eBPF loading, libncursesw6 for UI, libelf for symbol resolution, and SQLite3 for storage. The eBPF kernel modules are version-specific and support Linux kernels 4.17 through 5.6+. The project includes mock engines for testing and builds packages for Debian and RPM-based distributions. The codebase demonstrates strong software engineering practices: clear separation of concerns, use of design patterns (factory, strategy, observer via queues), thread-safe event handling, and comprehensive testing with Catch2. However, it has some technical drift risks due to reliance on specific kernel versions, an older version of Easylogging++, and a custom SysinternalsEBPF library that may change. The build process is well-documented with dev containers and CI pipelines.
The LLM identified 3 files worth highlighting for reuse:
A thread-safe double-buffered queue template that allows blocking pop with timeout and cancellation. It is self-contained, uses only standard library primitives (mutex, condition_variable, atomic), and can be extracted for use in any producer-consumer scenario requiring graceful shutdown. The double-buffering reduces contention and the cancellation flag enables clean thread termination.
An abstract base class EventFormatter defines virtual methods for formatting syscall event fields (timestamp, PID, process name, etc.). Concrete subclasses provide specific formatting for different event types (e.g., KillEventFormatter for kill-related syscalls). This pattern allows adding new event types without modifying the display logic, and the formatters are easily testable. The design is a clean example of the Strategy pattern applied to formatting.
A simple factory that creates either a MockStorageEngine or a Sqlite3StorageEngine based on a configuration flag. It enables the display and tracer layers to be unit tested without a real database, and allows swapping storage backends at runtime. The proxy encapsulates the creation logic and returns a base StorageEngine pointer, promoting loose coupling.