This can trace all processes on the host while strace traces one PID and its descendants. And bpf tracing does not stop processes at each syscall, so they run without slowdowns.
This project is from 2020 [1]. The title should actually be updated to reflect that.
Also we would have really go full circle if they used GPLv3 as the license :)
16 comments
[ 2.4 ms ] story [ 38.8 ms ] threadAnd is the output csv/logfile compatible with the windows equivalent? If so, that'd be amazing! tools like procdot can analyze/visualize the data:
https://procdot.com/
[1] https://github.com/microsoft/ProcMon-for-Linux/blob/main/LIC...
(All: feel free to downvote my neckbeard comment because I'm obviously in the wrong here)
I mean it.
It's quite limited for an auditing tool...