40+ Tools To See WHY Processes Run — 👁️ See Everything Your OS Hides

SRZ · January 25, 2026, 4:51pm

The “Why Is This Running?” Rabbit Hole — Every Tool The Pros Use To See What’s REALLY Happening On Your Machine

One question changed everything: “What if I could ask my computer WHY something is running — not just WHAT?”

The Full Excavation — 40+ Tools Across Every Platform, Ranked By Rarity

Someone dropped witr (Why Is This Running) in conversation. We went digging. Five tiers deep. Found tools security researchers gatekeep. Tools that don’t show up on page 1. Tools where you ask “where tf did you find this?”

Why this matters to YOU:

Malware hides as “svchost.exe” or “system” — these tools expose the family tree
Your slow computer? Something’s eating resources. Find it in seconds.
Pentesters, CTF players, sysadmins — this is your cheat sheet

What you’re getting:

Every platform covered (Linux, Windows, macOS, Android)
TIER rankings (S/A/B) — skip the mid tools
“Why It’s a Gem” breakdown for each
Comparison matrix so you pick the right one
Strategic recommendations from actual usage
Project ideas nobody’s built yet (free alpha)

LINUX

TIER S — The Hidden Gems

⭐ witr (Why Is This Running) — THE GOLD STANDARD

Link: https://github.com/pranshuparmar/witr

What it does: Give it a PID, port, or process name → get a human-readable explanation of the ENTIRE causal chain.

Why it’s a gem:

Instead of seeing node you see: systemd → pm2 → node (running /home/you/app)
Shows git repo, working directory, warnings
Synthesizes information into actual sentences — no other tool does this
Works on Linux + basic macOS support

The magic: Every other tool gives you RAW DATA. witr gives you an EXPLANATION.

Example output:

Process: node (PID 12847)
Started by: pm2 (process manager)
Which was started by: systemd (system service)
Working directory: /home/user/myproject
Git repo: https://github.com/user/myproject

No other tool talks to you like this.

⭐ tracexec — The Power User's Weapon

Link: https://github.com/kxxt/tracexec

What it does: Traces every execve syscall (program launch) with a beautiful TUI.

Why it’s a gem:

Written in Rust — fast af, single binary
TUI mode — watch exec events + interact with pseudo-terminal
eBPF mode (kernel 5.17+) — ultra-low overhead
ptrace fallback — works on older kernels, handles setuid binaries
Shows environment variable diffs between parent/child
Shows file descriptor changes
Can launch a debugger (gdb) attached to spawned processes mid-execution
Built by a practitioner debugging build systems

Use case: Trace what a shell script ACTUALLY executes. Attach debugger to subprocess in complex pipeline.

Installation:

cargo install tracexec
# OR download binary from releases

⭐ extrace — Minimalist Perfection

Link: https://github.com/leahneukirchen/extrace

What it does: Traces ALL exec() calls system-wide using Netlink connector.

Why it’s a gem:

Written by Void Linux maintainer (leahneukirchen) — practitioner credibility
Hierarchy indentation shows parent-child relationships visually
Pure C, minimal dependencies
Options: -d (cwd), -e (env), -t (exit status + duration), -u (user), -l (full path)
Can trace descendants of specific PID only

Example:

sudo extrace -d -t
# Shows every exec with working directory and how long it ran

Requires: CAP_NET_ADMIN or root

⭐ pspy — NO ROOT REQUIRED

Link: https://github.com/DominicBreuker/pspy

What it does: Monitors processes WITHOUT root access using inotify + procfs scanning.

Why it’s a gem:

CTF and pentest favorite — works when you can’t get root
Catches short-lived processes that ps misses
Shows commands run by OTHER USERS
Catches cron jobs and scheduled tasks
Single binary — just download and run

Flags:

-p print commands
-f filesystem events
-i scan interval

Binary releases: pspy32, pspy64 — no compilation needed

Use case: You’re on a box with limited privs. What’s running? Who’s running it? pspy knows.

⭐ execsnoop (BCC/bpftrace) — Brendan Gregg's Classic

Link: https://github.com/iovisor/bcc (execsnoop.py) | https://github.com/bpftrace/bpftrace (execsnoop.bt)

What it does: eBPF-powered tracing of execve() syscall.

Why it’s a gem:

Created by Brendan Gregg — the observability god
<1% overhead — safe for production
Part of bcc-tools package
Shows PID, PPID, return value, full command + args
Can filter by process name or failed execs

Installation:

apt install bpfcc-tools  # Debian/Ubuntu
# Then run:
execsnoop-bpfcc

TIER A — Solid Complements

🔧 forkstat

What it does: Netlink-based tracker for fork/exec/exit/clone/comm/uid/sid events.

Why it’s useful:

Shows parent PID → child PID with process names
Logs process duration on exit
Maintained by Colin Ian King (Ubuntu kernel team)

Installation:

apt install forkstat  # Debian/Ubuntu
yum install forkstat  # RHEL/CentOS

Requires: root or CAP_NET_ADMIN

🔧 strace-process-tree

Link: https://github.com/mgedmin/strace-process-tree

What it does: Reads strace -f output and produces a visual process tree.

Why it’s useful:

Post-mortem analysis — run strace, analyze later
Beautiful ASCII tree output showing fork/exec relationships
Pipe-friendly

Usage:

strace -f -e trace=process -s 1024 -o /tmp/trace.out make build
strace-process-tree /tmp/trace.out

Output example:

25510 make binary-package
├─25511 /bin/sh -c 'dpkg-parsechangelog...'
│ ├─25512 dpkg-parsechangelog
│ │ └─25514 tail -n 40 debian/changelog
│ └─25513 awk '$1 == "Source:" { print $2 }'

🔧 visual-strace — Browser-Based Visualization

Link: https://github.com/lhoursquentin/visual-strace

What it does: In-browser visual representation of strace output using cytoscape.js graphs.

Why it’s useful:

Visual graph — not just text
Shows forks, execves, pipes, exit status
Color-coded: green (success), red (non-zero exit), purple (signal death)
Orange arrows show read/write relationships between processes

Try it: https://lhoursquentin.github.io/visual-strace/

🔧 Microsoft ProcMon-for-Linux

Link: https://github.com/microsoft/ProcMon-for-Linux

What it does: Official Linux port of Sysinternals Process Monitor.

Why it’s useful:

Familiar interface for Windows users
TUI included
Traces syscall activity
Can output to file for later analysis

Usage:

sudo procmon  # TUI mode
sudo procmon -c /tmp/trace.db  # Headless mode

🔧 strace-parser (GitLab)

Link: https://gitlab.com/gitlab-com/support/toolbox/strace-parser

What it does: Summarizes strace output with per-PID statistics.

Why it’s useful:

Built by GitLab Support for debugging Gitaly/Unicorn
More detailed than strace -c
Shows parent/child process breakdown
Practitioner tool — battle-tested

TIER B — Specialized/Forensics

🔬 opentelemetry-ebpf-profiler

Link: https://github.com/open-telemetry/opentelemetry-ebpf-profiler

What it does: Whole-system cross-language profiler.

Why it’s useful:

Profiles C/C++, Go, Rust, Python, Java, Node, .NET, PHP, Ruby, Perl
1% CPU overhead, ~250MB memory
Mixed stacktraces from kernel → system libs → high-level language
No debug symbols required
CO-RE (works across kernel versions)

🔬 redcanary-ebpf-sensor

Link: https://github.com/redcanaryco/redcanary-ebpf-sensor

What it does: Security-focused BPF programs for kernel event collection.

Why it’s useful:

Gathers process lineage, network connections, file access
Selectively loads probes based on kernel version
Made by Red Canary (legit security company)

🔬 dockerfileview

Link: https://github.com/remore/dockerfileview

What it does: Traces Docker image ancestry.

Why it’s useful:

See the full Dockerfile chain from base image to current
dockerfileview nginx:1.9.2 reveals all FROM layers

WINDOWS

TIER S — The Hidden Gems

⭐ wuanzhuan/system_monitor — Rust ETW Procmon Replacement

Link: https://github.com/wuanzhuan/system_monitor

What it does: Windows kernel event monitoring via ETW, written in Rust.

Why it’s a gem:

Literal procmon replacement — the description says it
More events and better filtering than original
Handle leak detection — can run for WEEKS tracking leaks
Rust = memory safe, fast, modern

Use case: Debug handle leaks that only manifest after days of runtime. Original ProcMon can’t do this reliably.

⭐ wtrace — Single Binary CLI Power

Link: https://github.com/lowleveldesign/wtrace

What it does: Command-line ETW tracing tool.

Why it’s a gem:

Single .exe file — no install
Traces file I/O, registry, network, RPC calls
Process tree in summary — shows hierarchy at end of session
Can trace specific process + all children with -c
Resolves RPC procedure names
Works on Windows 8.1+

Installation:

choco install wtrace
# OR download from GitHub releases

Usage:

wtrace notepad c:\temp\test.txt  # Start and trace
wtrace -c 1234                    # Trace PID and children
wtrace --handlers file -f 'eventname=FileIO/Write'  # Filter

⭐ ferrisetw — Rust KrabsETW

Link: https://github.com/n4r1b/ferrisetw

What it does: Rust library for ETW consumption.

Why it’s a gem:

Started as KrabsETW port, now diverging with Rust idioms
Full ETW provider support
Proper Rust error handling
Actively maintained
Credits Microsoft’s KrabsETW team

Use case: Building your own Rust-based monitoring tools on Windows.

TIER A — Solid Alternatives

🔧 krabsetw (Microsoft Official)

Link: https://github.com/microsoft/krabsetw

What it does: Modern C++ and .NET wrapper for ETW.

Why it’s useful:

Made by Microsoft (Office 365 Security team)
Production-proven
Called “Lobsters” internally
NuGet packages available

Use case: Building enterprise monitoring tools in C++ or .NET.

🔧 ProcMonX / ProcMonXv2

Link: https://github.com/zodiacon/ProcMonX | https://github.com/zodiacon/ProcMonXv2

What it does: Extended Process Monitor using ETW instead of kernel driver.

Why it’s useful:

No kernel driver needed — ETW only
Made by Pavel Yosifovich (Windows Internals expert)
GUI interface
v2 is the newer version

🔧 PowerKrabsEtw

Link: https://github.com/zacbrown/PowerKrabsEtw

What it does: PowerShell interface for real-time ETW tracing.

Why it’s useful:

Trace-KrabsEtwProcess — like ProcMon for specific process
Create custom providers, filters, traces
PowerShell-native (no compiled binaries needed for basic use)

Note: Start PowerShell with -MTA flag.

🔧 UIforETW (Google)

Link: https://github.com/google/UIforETW

What it does: User interface for recording and managing ETW traces.

Why it’s useful:

Made by Google — used for Chrome performance
Works around bugs in Windows Performance Toolkit
Records additional context (user input, CPU temp)
Fixes symbol loading issues
Categorizes Chrome processes automatically

Tutorials: https://tinyurl.com/etwcentral

🔧 VISION-ProcMon

Link: https://github.com/forensicxlab/VISION-ProcMon

What it does: Rust + Tauri visualization for ProcMon output.

Why it’s useful:

Malware analysis focused
Beautiful web-based visualization
Cross-platform (Tauri)
Designed for behavioral analysis

TIER B — Built-in / Reference

🔬 Built-in Windows Commands

Hidden gems most people don’t know:

# Quick process tree with parent info
wmic process get processid,parentprocessid,commandline

# ETW providers list
logman query providers

# ETW provider details
logman query providers Microsoft-Windows-Kernel-Process

Event Log: Event ID 4688 (Process Creation) — requires Audit Process Creation policy enabled.

🔬 ETWExplorer

Use for deep provider inspection — see what events and data each provider offers.

Referenced in multiple red team resources for understanding ETW capabilities.

macOS

TIER S — The Hidden Gems

⭐ mac-monitor — 'The Missing ProcMon for macOS'

Link: https://github.com/redcanaryco/mac-monitor

What it does: Full Endpoint Security event monitoring with GUI.

Why it’s a gem:

Made by Red Canary — real security company
Process lineage subtree — click any event, see the family tree
Event correlation — related events grouped together
Dynamic event subscriptions — modify what you’re watching on the fly
Path muting at API level
High fidelity ES events with enrichment (File Quarantine, code signing certs)
Exports to ESLogger-compatible JSON

Requirements:

Apple Silicon recommended (Intel works)
Full Disk Access permission
System Extension approval

Installation: Download from https://github.com/Brandon7CC/mac-monitor/releases

⭐ eslogger — Already On Your Mac

What it does: Built-in Endpoint Security framework logger (macOS 13+).

Why it’s a gem:

No SIP disable needed
No extra software
JSON output — pipe to jq for filtering
Works with Full Disk Access permission

Usage:

# List all executables launched
sudo eslogger exec | jq -r '.event.exec.target.executable.path'

# Monitor files accessed by git
sudo eslogger stat | jq -r 'select(.process.executable.path | test("/git$")) | .event.stat.target.path'

Note: Apple doesn’t guarantee stable API — but it works great for research.

⭐ strace-macos

Link: https://github.com/Mic92/strace-macos

What it does: strace clone for macOS.

Why it’s a gem:

Finally, actual strace on Mac
Install via pipx: env PIPX_DEFAULT_PYTHON='/usr/bin/python3' pipx install git+https://github.com/Mic92/strace-macos

TIER A — Solid Alternatives

🔧 esl

Link: https://github.com/tstromberg/esl

What it does: Go library for consuming EndpointSecurity events via eslogger.

Why it’s useful:

Programmatic access to eslogger
Example CLI included
Experimental but functional

🔧 esfriend

Link: https://github.com/mcarmanize/esfriend

What it does: Minimal malware analysis sandbox for macOS.

Why it’s useful:

Uses eslogger for event collection
Designed for physical Mac as sandbox
Uses Faronics Deep Freeze for cleanup
Split exec/close events for accuracy

🔧 DTraceToolkit

Link: https://www.brendangregg.com/dtrace.html

What it does: 200+ DTrace scripts by Brendan Gregg.

Why it’s useful:

The OG observability toolkit
Scripts for process, I/O, network, everything
Many included in macOS by default

Key scripts:

# New processes with arguments
sudo dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'

# Files opened by process
sudo dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'

Note: Requires SIP disabled for full functionality. Or use eslogger instead.

🔧 fs_usage — Built-in

What it does: File system usage monitor.

Usage:

sudo fs_usage -w -f exec  # Trace all exec calls

Already installed on every Mac.

TIER B — Reference

🔬 Endpoint Security Framework Deep Dive

Wiki: https://github.com/redcanaryco/mac-monitor/wiki

Covers:

ES API internals
Client initialization
Event subscriptions
endpointsecurityd daemon analysis
Frida instrumentation techniques

Required reading if building ES-based tools.

ANDROID

TIER A — The Main Tools

🔧 Frida — The Swiss Army Knife

Link: https://frida.re/

What it does: Dynamic instrumentation toolkit — inject scripts into running apps.

Why it’s the standard:

Works on Android, iOS, Windows, macOS, Linux
frida-ps -U — list processes on USB device
frida-trace -U -i open -N com.app — trace function calls
Bypass root detection, SSL pinning
Massive community + script library: https://codeshare.frida.re/

Setup:

# On computer
pip install frida-tools

# On rooted Android device
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"

# Test
frida-ps -U

Note: Requires rooted device OR Frida Gadget injection for non-rooted.

🔧 android-trace

Link: https://github.com/HayesGordon/android-trace

What it does: Frida-node CLI wrapper for class/method tracing.

Why it’s useful:

Easier than raw Frida for class enumeration
Filter by regex
JSON config for batch tracing

Usage:

node index.js -U -n com.app.package -F "com.app.package"

🔧 strace for Android

Links:

https://github.com/hnw/strace-android-ndk (NDK build)
https://github.com/xdbob/strace (with Binder support)

Why the Binder fork matters: Android IPC uses Binder protocol. Stock strace doesn’t decode it. xdbob’s fork does.

TIER B — Built-in Tools

🔬 ADB Built-in Commands

# See app launches (events log)
adb logcat -b events | grep am_proc_start

# Process hierarchy and who started what
adb shell dumpsys activity processes

# Basic parent-child relationships
adb shell ps -A -o PID,PPID,NAME

# Get APK path
adb shell pm path com.app.package

# Send input events
adb shell input tap 500 500

CROSS-PLATFORM / BONUS

🎨 r-top — Rust TUI with Shaders

Link: https://github.com/asian-mario/r-top

What it does: Process monitor/manager with visual effects.

Platform: Unix-like systems

Why it’s cool: Uses ratatui + tachyonfx for shader effects. Looks amazing.

🎨 rustnet-monitor

Link: https://docs.rs/crate/rustnet-monitor/latest

What it does: Cross-platform network monitoring TUI.

Platforms: Linux (eBPF), macOS (getifaddrs), Windows (GetIfTable2)

Features:

Real-time TCP/UDP/ICMP/ARP monitoring
Connection state tracking
Deep packet inspection
eBPF on Linux for low overhead

FULL COMPARISON MATRIX

Tool	Platform	Explains WHY	Real-time	eBPF/ETW	TUI/GUI	Process Tree
witr	Linux/macOS	BEST				text
tracexec	Linux	raw			TUI
extrace	Linux	raw				indent
execsnoop	Linux
pspy	Linux
forkstat	Linux
strace-process-tree	Linux		post
visual-strace	Linux		post		web	graph
system_monitor	Windows	raw		ETW
wtrace	Windows	raw		ETW		summary
ProcMonX	Windows	raw		ETW	GUI
mac-monitor	macOS	raw		ES API	GUI
eslogger	macOS			ES API
Frida	All

Legend:

= Yes
= No
raw = Shows data but YOU interpret it (vs witr which explains)

STRATEGIC RECOMMENDATIONS

Quick Reference: Which Tool For Which Job

Situation	Linux	Windows	macOS	Android
“Explain this process”	witr	—	witr	—
Watch everything live	tracexec	wtrace	mac-monitor	Frida
No admin/root access	pspy	—	—	—
Production monitoring	execsnoop	system_monitor	eslogger	—
Post-mortem analysis	strace-process-tree	VISION-ProcMon	—	—
Visual graphs	visual-strace	ProcMonX	mac-monitor	—
Build custom tools	bcc/bpftrace	krabsetw	esl	Frida

Upgrade Path (Code Block)

QUICK CHECK:      witr (Linux/Mac) — still the best for explanation synthesis
DEEP DEBUGGING:   tracexec (Linux) | mac-monitor (macOS) | wtrace (Windows)
PRODUCTION:       execsnoop (Linux eBPF) | system_monitor (Windows ETW)
NO ROOT:          pspy (Linux) | eslogger (macOS)
VISUALIZATION:    visual-strace (browser) | strace-process-tree (CLI)
MOBILE:           Frida (Android/iOS)

WHAT DOESN’T EXIST YET (Project Ideas)

These tools would complete the ecosystem but nobody’s built them:

Gap	Description	Difficulty
Cross-platform witr	Same “explain why” synthesis on Windows/macOS	Medium
Historical explainer	“Why was this running at 3am?” using audit logs	Hard
Package-aware identifier	“This is nginx from apt” or “node from nvm”	Medium
AI process explainer	LLM summarizing process chains into plain English	Easy-Medium
Unified timeline	Merge events from multiple tools into single view	Hard

Free startup ideas. You’re welcome.

VALIDATION: Why This List Is Different

How we know these are real gems:

Not page-1 Google results
Posted by practitioners (kxxt, leahneukirchen, Brendan Gregg, Colin Ian King, Pavel Yosifovich)
All have working binaries/packages
Provides actual leverage (debugging, security, forensics)
“Where tf did you find this?” factor
Beginners don’t stumble on these accidentally

Failed search paths (so you don’t waste time):

“process ancestry” → returns genealogy software (Gramps, GEDCOM)
“Linux process monitor” → returns top/htop tutorials
“systemd process origin” → returns GitHub issues, not tools
Generic Rust/Go process spawn searches → language stdlib issues

MASTER LINK LIST

Linux

Tool	Link
witr	https://github.com/pranshuparmar/witr
tracexec	https://github.com/kxxt/tracexec
extrace	https://github.com/leahneukirchen/extrace
pspy	https://github.com/DominicBreuker/pspy
execsnoop (bcc)	https://github.com/iovisor/bcc
execsnoop (bpftrace)	https://github.com/bpftrace/bpftrace
forkstat	`apt install forkstat`
strace-process-tree	https://github.com/mgedmin/strace-process-tree
visual-strace	https://github.com/lhoursquentin/visual-strace
ProcMon-for-Linux	https://github.com/microsoft/ProcMon-for-Linux
strace-parser	https://gitlab.com/gitlab-com/support/toolbox/strace-parser
opentelemetry-ebpf-profiler	https://github.com/open-telemetry/opentelemetry-ebpf-profiler
redcanary-ebpf-sensor	https://github.com/redcanaryco/redcanary-ebpf-sensor
dockerfileview	https://github.com/remore/dockerfileview

Windows

Tool	Link
system_monitor	https://github.com/wuanzhuan/system_monitor
wtrace	https://github.com/lowleveldesign/wtrace
ferrisetw	https://github.com/n4r1b/ferrisetw
krabsetw	https://github.com/microsoft/krabsetw
ProcMonX	https://github.com/zodiacon/ProcMonX
ProcMonXv2	https://github.com/zodiacon/ProcMonXv2
PowerKrabsEtw	https://github.com/zacbrown/PowerKrabsEtw
UIforETW	https://github.com/google/UIforETW
VISION-ProcMon	https://github.com/forensicxlab/VISION-ProcMon

macOS

Tool	Link
mac-monitor	https://github.com/redcanaryco/mac-monitor
eslogger	Built-in (macOS 13+)
strace-macos	https://github.com/Mic92/strace-macos
esl	https://github.com/tstromberg/esl
esfriend	https://github.com/mcarmanize/esfriend
DTraceToolkit	https://www.brendangregg.com/dtrace.html

Android

Tool	Link
Frida	https://frida.re/
android-trace	https://github.com/HayesGordon/android-trace
strace-android-ndk	https://github.com/hnw/strace-android-ndk
strace (Binder)	https://github.com/xdbob/strace

Cross-Platform

Tool	Link
r-top	https://github.com/asian-mario/r-top
rustnet-monitor	https://docs.rs/crate/rustnet-monitor/latest

Your computer’s been keeping secrets. Now you have the tools to read its diary.

Emanuel_Branson · January 25, 2026, 5:00pm

Thank you for the marvelous share @SRZ as always.

Topic		Replies	Views
Collection of Free Hacker Tracking & Research Tools & Find Anything Tools & Scripts hacking , freebies , trading	3	1240	December 16, 2025
Tracee \| Container And System Event Tracing Using eBPF Tools & Scripts tools , freebies , technology	0	644	August 27, 2021
Your PC Reports Everything You Type — Here's How to Kill It 🛡️ Tutorials & Methods privacy , freebies	0	208	February 5, 2026
🔎 50+ Resources to Investigate People & Websites Tools & Scripts freebies , data-recovery , trading	2	830	December 30, 2025
The Best Computer Forensics Tools \| Explained Tools & Scripts tools , tips-tricks	0	1237	June 4, 2023

40+ Tools To See WHY Processes Run — 👁️ See Everything Your OS Hides

The “Why Is This Running?” Rabbit Hole — Every Tool The Pros Use To See What’s REALLY Happening On Your Machine

The Full Excavation — 40+ Tools Across Every Platform, Ranked By Rarity

LINUX

TIER S — The Hidden Gems

TIER A — Solid Complements

TIER B — Specialized/Forensics

WINDOWS

TIER S — The Hidden Gems

TIER A — Solid Alternatives

TIER B — Built-in / Reference

macOS

TIER S — The Hidden Gems

TIER A — Solid Alternatives

TIER B — Reference

ANDROID

TIER A — The Main Tools

TIER B — Built-in Tools

CROSS-PLATFORM / BONUS

FULL COMPARISON MATRIX

STRATEGIC RECOMMENDATIONS

Quick Reference: Which Tool For Which Job

Upgrade Path (Code Block)

WHAT DOESN’T EXIST YET (Project Ideas)

VALIDATION: Why This List Is Different

MASTER LINK LIST

Linux

Windows

macOS

Android

Cross-Platform

Related topics