Process Monitor equivalent for Linux?

Question

Is there a Unix/Linux equivalent of Process Monitor, whether GUI or CUI?

If it makes a difference, I'm looking at Ubuntu, but if there's an equivalent for other systems (Mac, other Linux variants like Fedora, etc.) then knowing any of those would be useful too.

Edit:

Process Monitor is for monitoring system calls (such as file creation or writes), while Process Explorer is for monitoring process status (which is like System Monitor). I'm asking for the former, not the latter. :-)

score 16 · Answer 1 · edited Apr 13 '17 at 12:36

The grandaddy of all process monitors is top, and many system monitoring tools are called top. For example, there's iotop to watch disk I/O, atop for a bunch of system resources, powertop for power consumption.

If you want more detailed information, it's not tracked by default. To watch what a particular process is doing, call strace on it. For example, if you're only interested in filesystem accesses:

strace -s9999 -efile command_name    # trace a program during its whole execution
strace -s9999 -efile -p1234          # trace a running program with the given PID

strace is specific to Linux, but other systems have a similar tool: truss on Solaris, ktrace or dtrace under *BSD, etc.

To watch what's happening to a particular file or in a particular directory or directory tree, use the inotify facility.

inotifywait -m .

Again, the facility is specific to Linux, but most other unices have a similar system, e.g. kqueue under *BSD, and FAM (originally from SGI but now available as an API on many systems).

To watch all the system calls under Linux, you can use the audit subsystem. It's relatively recent and there's not much literature on the topic; search for auditctl or read the auditctl man page. There are a couple of examples on this site: tracking file accesses, tracking process execution.

Are you sure you're referring to the equivalent of Process Monitor, and not Process Explorer? — user541686, May 21 '11 at 20:38
@Mehrdad: I see, I'd gone by the name and my memory of a tool I'd used on Windows (which is in fact Process Explorer), and not by the actual description. It's always dangerous to ask for the equivalent of a particular program, better to ask for a program with certain features. — Gilles 'SO- stop being evil', May 21 '11 at 20:45
Thank you. iotop -o -b -P shows me which processes are doing disk I/O operations — bartolo-otrit, Jul 27 '18 at 06:17

Caleb · Accepted Answer · 2011-05-21T20:51:50.537

14

The console standby for this is top, but there are alternatives like my favorite htop that give you a little more display flexibility and allow you a few more operations on the processes.

A less interactive view that is better for use in scripts would be the ps program and all it's relatives.

Edit: Based on your clarified question, you might note that strace handles watching system calls made by a given process including all read-write operations and os function calls. You can activate it on the command line before the program you want to track or attach to a running process by hitting s on a process selected in htop.

edited May 21 '11 at 20:51

answered May 21 '11 at 20:20

Caleb

70,105

7

I believe top is the equivalent of Process Explorer, not Process Monitor, right? – user541686 May 21 '11 at 20:30
How about you run it and explore the man page. I read through the feature list you linked to of process monitor and it sounded like htop covered all the details except boot sequence monitoring. At best it could be activated in screen/tmux sometime part way through a linux boot cylce. – Caleb May 21 '11 at 20:49
1

In light of your other comments, you might also be looking for strace, which you can activate from htop by hitting s on a process or manually from the command line when you run something or with a process id. – Caleb May 21 '11 at 20:50

score 9 · Answer 3 · answered May 21 '11 at 20:53

9

You may want to take a look at lsof and strace. Sysinternal's Process Monitor is actually Filemon and Regmon combined with a some additional enhancements. The top command is more like Process Explorer.

answered May 21 '11 at 20:53

Omega

91

score 4 · Answer 4 · answered Mar 12 '14 at 19:43

4

I'm really late for answering this, but I have started a project that aims to do exactly what you're looking for. Have a look at it here: https://github.com/alexandernst/monks

answered Mar 12 '14 at 19:43

alexandernst

238

score 4 · Answer 5 · answered Nov 16 '15 at 07:58

4

You are probably looking for sysdig

For example:

sysdig -A -c echo_fds

answered Nov 16 '15 at 07:58

Singlet

141

score 2 · Answer 6 · answered May 21 '11 at 20:15

2

I've not used that Process Monitor, but as far as I can tell it's the same as gnome-system-monitor on a Gnome system. If you use KDE they probably have something similar.

answered May 21 '11 at 20:15

Keith

7,914
1
28
29

1

No, they're different. Process Monitor actually hooks system calls, not display process information. (What you're referring to is accomplished by Process Explorer, though.) – user541686 May 21 '11 at 20:31
Oh, well I usually use the CLI tool vmstat for things like that. But that's system wide, not per process. – Keith May 21 '11 at 20:47

score 1 · Answer 7 · answered Nov 16 '15 at 08:36

1

dtrace4linux allows you to trace some interesting tidbits of the kernel. Although it appears to be more powerful than sysdig, unfortunately is not so well behaved.

answered Nov 16 '15 at 08:36

Rui F Ribeiro

56,709
26
150
232

score 0 · Answer 8 · answered Jul 17 '20 at 18:07

0

This was just released yesterday:

https://github.com/microsoft/ProcMon-for-Linux

answered Jul 17 '20 at 18:07

Alan McBee

101

Process Monitor equivalent for Linux?

Edit:

8 Answers8

Linked