# 40+ Tools To See WHY Processes Run — 👁️ See Everything Your OS Hides

**URL:** <https://onehack.st/t/40-tools-to-see-why-processes-run-see-everything-your-os-hides/317367>\
**Category:** Tools & Scripts\
**Tags:** tools, privacy, freebies\
**Created:** [January 25, 2026, 4:51pm UTC](https://onehack.st/t/40-tools-to-see-why-processes-run-see-everything-your-os-hides/317367 "2026-01-25T16:51:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [January 25, 2026, 4:51pm UTC](https://onehack.st/t/40-tools-to-see-why-processes-run-see-everything-your-os-hides/317367/1 "2026-01-25T16:51:44Z")

</div>

# 🕳 The “Why Is This Running?” Rabbit Hole — Every Tool The Pros Use To See What’s REALLY Happening On Your Machine

_One question changed everything: “What if I could ask my computer WHY something is running — not just WHAT?”_

* * *

> ## 🗺 The Full Excavation — 40+ Tools Across Every Platform, Ranked By Rarity
> 
> Someone dropped `witr` (Why Is This Running) in conversation. We went digging. Five tiers deep. Found tools security researchers gatekeep. Tools that don’t show up on page 1. Tools where you ask “where tf did you find this?”

**Why this matters to YOU:**

- 🛡 Malware hides as “svchost.exe” or “system” — these tools expose the family tree
- 💸 Your slow computer? Something’s eating resources. Find it in seconds.
- 🔓 Pentesters, CTF players, sysadmins — this is your cheat sheet

**What you’re getting:**

- ✅ Every platform covered (Linux, Windows, macOS, Android)
- ✅ TIER rankings (S/A/B) — skip the mid tools
- ✅ “Why It’s a Gem” breakdown for each
- ✅ Comparison matrix so you pick the right one
- ✅ Strategic recommendations from actual usage
- ✅ Project ideas nobody’s built yet (free alpha)

* * *

# 🐧 LINUX

## TIER S — The Hidden Gems

> **⭐ witr (Why Is This Running) — THE GOLD STANDARD**
>
> **Link:** [https://github.com/pranshuparmar/witr](https://github.com/pranshuparmar/witr)
> 
> **What it does:** Give it a PID, port, or process name → get a human-readable explanation of the ENTIRE causal chain.
> 
> **Why it’s a gem:**
> 
> - Instead of seeing `node` you see: `systemd → pm2 → node (running /home/you/app)`
> - Shows git repo, working directory, warnings
> - Synthesizes information into **actual sentences** — no other tool does this
> - Works on Linux + basic macOS support
> 
> **The magic:** Every other tool gives you RAW DATA. witr gives you an **EXPLANATION**.
> 
> **Example output:**
> 
> ```auto
> Process: node (PID 12847)
> Started by: pm2 (process manager)
> Which was started by: systemd (system service)
> Working directory: /home/user/myproject
> Git repo: https://github.com/user/myproject
> 
> ```
> 
> No other tool talks to you like this.

> **⭐ tracexec — The Power User's Weapon**
>
> **Link:** [https://github.com/kxxt/tracexec](https://github.com/kxxt/tracexec)
> 
> **What it does:** Traces every `execve` syscall (program launch) with a beautiful TUI.
> 
> **Why it’s a gem:**
> 
> - Written in Rust — fast af, single binary
> - **TUI mode** — watch exec events + interact with pseudo-terminal
> - **eBPF mode** (kernel 5.17+) — ultra-low overhead
> - **ptrace fallback** — works on older kernels, handles setuid binaries
> - Shows **environment variable diffs** between parent/child
> - Shows **file descriptor changes**
> - Can **launch a debugger (gdb) attached to spawned processes mid-execution**
> - Built by a practitioner debugging build systems
> 
> **Use case:** Trace what a shell script ACTUALLY executes. Attach debugger to subprocess in complex pipeline.
> 
> **Installation:**
> 
> ```bash
> cargo install tracexec
> # OR download binary from releases
> 
> ```

> **⭐ extrace — Minimalist Perfection**
>
> **Link:** [https://github.com/leahneukirchen/extrace](https://github.com/leahneukirchen/extrace)
> 
> **What it does:** Traces ALL `exec()` calls system-wide using Netlink connector.
> 
> **Why it’s a gem:**
> 
> - Written by Void Linux maintainer (leahneukirchen) — practitioner credibility
> - **Hierarchy indentation** shows parent-child relationships visually
> - Pure C, minimal dependencies
> - Options: `-d` (cwd), `-e` (env), `-t` (exit status + duration), `-u` (user), `-l` (full path)
> - Can trace **descendants of specific PID only**
> 
> **Example:**
> 
> ```bash
> sudo extrace -d -t
> # Shows every exec with working directory and how long it ran
> 
> ```
> 
> **Requires:** CAP\_NET\_ADMIN or root

> **⭐ pspy — NO ROOT REQUIRED**
>
> **Link:** [https://github.com/DominicBreuker/pspy](https://github.com/DominicBreuker/pspy)
> 
> **What it does:** Monitors processes WITHOUT root access using inotify + procfs scanning.
> 
> **Why it’s a gem:**
> 
> - **CTF and pentest favorite** — works when you can’t get root
> - Catches short-lived processes that `ps` misses
> - Shows commands run by OTHER USERS
> - Catches cron jobs and scheduled tasks
> - Single binary — just download and run
> 
> **Flags:**
> 
> - `-p` print commands
> - `-f` filesystem events
> - `-i` scan interval
> 
> **Binary releases:** `pspy32`, `pspy64` — no compilation needed
> 
> **Use case:** You’re on a box with limited privs. What’s running? Who’s running it? pspy knows.

> **⭐ execsnoop (BCC/bpftrace) — Brendan Gregg's Classic**
>
> **Link:** [https://github.com/iovisor/bcc](https://github.com/iovisor/bcc) (execsnoop.py) | [https://github.com/bpftrace/bpftrace](https://github.com/bpftrace/bpftrace) (execsnoop.bt)
> 
> **What it does:** eBPF-powered tracing of `execve()` syscall.
> 
> **Why it’s a gem:**
> 
> - Created by **Brendan Gregg** — the observability god
> - **\<1% overhead** — safe for production
> - Part of `bcc-tools` package
> - Shows PID, PPID, return value, full command + args
> - Can filter by process name or failed execs
> 
> **Installation:**
> 
> ```bash
> apt install bpfcc-tools # Debian/Ubuntu
> # Then run:
> execsnoop-bpfcc
> 
> ```

## TIER A — Solid Complements

> **🔧 forkstat**
>
> **What it does:** Netlink-based tracker for fork/exec/exit/clone/comm/uid/sid events.
> 
> **Why it’s useful:**
> 
> - Shows parent PID → child PID with process names
> - Logs process duration on exit
> - Maintained by Colin Ian King (Ubuntu kernel team)
> 
> **Installation:**
> 
> ```bash
> apt install forkstat # Debian/Ubuntu
> yum install forkstat # RHEL/CentOS
> 
> ```
> 
> **Requires:** root or CAP\_NET\_ADMIN

> **🔧 strace-process-tree**
>
> **Link:** [https://github.com/mgedmin/strace-process-tree](https://github.com/mgedmin/strace-process-tree)
> 
> **What it does:** Reads `strace -f` output and produces a visual process tree.
> 
> **Why it’s useful:**
> 
> - Post-mortem analysis — run strace, analyze later
> - Beautiful ASCII tree output showing fork/exec relationships
> - Pipe-friendly
> 
> **Usage:**
> 
> ```bash
> strace -f -e trace=process -s 1024 -o /tmp/trace.out make build
> strace-process-tree /tmp/trace.out
> 
> ```
> 
> **Output example:**
> 
> ```auto
> 25510 make binary-package
> ├─25511 /bin/sh -c 'dpkg-parsechangelog...'
> │ ├─25512 dpkg-parsechangelog
> │ │ └─25514 tail -n 40 debian/changelog
> │ └─25513 awk '$1 == "Source:" { print $2 }'
> 
> ```

> **🔧 visual-strace — Browser-Based Visualization**
>
> **Link:** [https://github.com/lhoursquentin/visual-strace](https://github.com/lhoursquentin/visual-strace)
> 
> **What it does:** In-browser visual representation of strace output using cytoscape.js graphs.
> 
> **Why it’s useful:**
> 
> - **Visual graph** — not just text
> - Shows forks, execves, pipes, exit status
> - Color-coded: green (success), red (non-zero exit), purple (signal death)
> - Orange arrows show read/write relationships between processes
> 
> **Try it:** [https://lhoursquentin.github.io/visual-strace/](https://lhoursquentin.github.io/visual-strace/)

> **🔧 Microsoft ProcMon-for-Linux**
>
> **Link:** [https://github.com/microsoft/ProcMon-for-Linux](https://github.com/microsoft/ProcMon-for-Linux)
> 
> **What it does:** Official Linux port of Sysinternals Process Monitor.
> 
> **Why it’s useful:**
> 
> - Familiar interface for Windows users
> - TUI included
> - Traces syscall activity
> - Can output to file for later analysis
> 
> **Usage:**
> 
> ```bash
> sudo procmon # TUI mode
> sudo procmon -c /tmp/trace.db # Headless mode
> 
> ```

> **🔧 strace-parser (GitLab)**
>
> **Link:** [https://gitlab.com/gitlab-com/support/toolbox/strace-parser](https://gitlab.com/gitlab-com/support/toolbox/strace-parser)
> 
> **What it does:** Summarizes strace output with per-PID statistics.
> 
> **Why it’s useful:**
> 
> - Built by GitLab Support for debugging Gitaly/Unicorn
> - More detailed than `strace -c`
> - Shows parent/child process breakdown
> - Practitioner tool — battle-tested

## TIER B — Specialized/Forensics

> **🔬 opentelemetry-ebpf-profiler**
>
> **Link:** [https://github.com/open-telemetry/opentelemetry-ebpf-profiler](https://github.com/open-telemetry/opentelemetry-ebpf-profiler)
> 
> **What it does:** Whole-system cross-language profiler.
> 
> **Why it’s useful:**
> 
> - Profiles C/C++, Go, Rust, Python, Java, Node, .NET, PHP, Ruby, Perl
> - **1% CPU overhead** , ~250MB memory
> - Mixed stacktraces from kernel → system libs → high-level language
> - No debug symbols required
> - CO-RE (works across kernel versions)

> **🔬 redcanary-ebpf-sensor**
>
> **Link:** [https://github.com/redcanaryco/redcanary-ebpf-sensor](https://github.com/redcanaryco/redcanary-ebpf-sensor)
> 
> **What it does:** Security-focused BPF programs for kernel event collection.
> 
> **Why it’s useful:**
> 
> - Gathers process lineage, network connections, file access
> - Selectively loads probes based on kernel version
> - Made by Red Canary (legit security company)

> **🔬 dockerfileview**
>
> **Link:** [https://github.com/remore/dockerfileview](https://github.com/remore/dockerfileview)
> 
> **What it does:** Traces Docker image ancestry.
> 
> **Why it’s useful:**
> 
> - See the full Dockerfile chain from base image to current
> - `dockerfileview nginx:1.9.2` reveals all FROM layers

* * *

# 🪟 WINDOWS

## TIER S — The Hidden Gems

> **⭐ wuanzhuan/system\_monitor — Rust ETW Procmon Replacement**
>
> **Link:** [https://github.com/wuanzhuan/system\_monitor](https://github.com/wuanzhuan/system_monitor)
> 
> **What it does:** Windows kernel event monitoring via ETW, written in Rust.
> 
> **Why it’s a gem:**
> 
> - **Literal procmon replacement** — the description says it
> - More events and better filtering than original
> - **Handle leak detection** — can run for WEEKS tracking leaks
> - Rust = memory safe, fast, modern
> 
> **Use case:** Debug handle leaks that only manifest after days of runtime. Original ProcMon can’t do this reliably.

> **⭐ wtrace — Single Binary CLI Power**
>
> **Link:** [https://github.com/lowleveldesign/wtrace](https://github.com/lowleveldesign/wtrace)
> 
> **What it does:** Command-line ETW tracing tool.
> 
> **Why it’s a gem:**
> 
> - **Single .exe file** — no install
> - Traces file I/O, registry, network, RPC calls
> - **Process tree in summary** — shows hierarchy at end of session
> - Can trace specific process + all children with `-c`
> - Resolves RPC procedure names
> - Works on Windows 8.1+
> 
> **Installation:**
> 
> ```powershell
> choco install wtrace
> # OR download from GitHub releases
> 
> ```
> 
> **Usage:**
> 
> ```powershell
> wtrace notepad c:\temp\test.txt # Start and trace
> wtrace -c 1234 # Trace PID and children
> wtrace --handlers file -f 'eventname=FileIO/Write' # Filter
> 
> ```

> **⭐ ferrisetw — Rust KrabsETW**
>
> **Link:** [https://github.com/n4r1b/ferrisetw](https://github.com/n4r1b/ferrisetw)
> 
> **What it does:** Rust library for ETW consumption.
> 
> **Why it’s a gem:**
> 
> - Started as KrabsETW port, now diverging with Rust idioms
> - Full ETW provider support
> - Proper Rust error handling
> - Actively maintained
> - Credits Microsoft’s KrabsETW team
> 
> **Use case:** Building your own Rust-based monitoring tools on Windows.

## TIER A — Solid Alternatives

> **🔧 krabsetw (Microsoft Official)**
>
> **Link:** [https://github.com/microsoft/krabsetw](https://github.com/microsoft/krabsetw)
> 
> **What it does:** Modern C++ and .NET wrapper for ETW.
> 
> **Why it’s useful:**
> 
> - **Made by Microsoft** (Office 365 Security team)
> - Production-proven
> - Called “Lobsters” internally
> - NuGet packages available
> 
> **Use case:** Building enterprise monitoring tools in C++ or .NET.

> **🔧 ProcMonX / ProcMonXv2**
>
> **Link:** [https://github.com/zodiacon/ProcMonX](https://github.com/zodiacon/ProcMonX) | [https://github.com/zodiacon/ProcMonXv2](https://github.com/zodiacon/ProcMonXv2)
> 
> **What it does:** Extended Process Monitor using ETW instead of kernel driver.
> 
> **Why it’s useful:**
> 
> - **No kernel driver needed** — ETW only
> - Made by Pavel Yosifovich (Windows Internals expert)
> - GUI interface
> - v2 is the newer version

> **🔧 PowerKrabsEtw**
>
> **Link:** [https://github.com/zacbrown/PowerKrabsEtw](https://github.com/zacbrown/PowerKrabsEtw)
> 
> **What it does:** PowerShell interface for real-time ETW tracing.
> 
> **Why it’s useful:**
> 
> - `Trace-KrabsEtwProcess` — like ProcMon for specific process
> - Create custom providers, filters, traces
> - PowerShell-native (no compiled binaries needed for basic use)
> 
> **Note:** Start PowerShell with `-MTA` flag.

> **🔧 UIforETW (Google)**
>
> **Link:** [https://github.com/google/UIforETW](https://github.com/google/UIforETW)
> 
> **What it does:** User interface for recording and managing ETW traces.
> 
> **Why it’s useful:**
> 
> - **Made by Google** — used for Chrome performance
> - Works around bugs in Windows Performance Toolkit
> - Records additional context (user input, CPU temp)
> - Fixes symbol loading issues
> - Categorizes Chrome processes automatically
> 
> **Tutorials:** [https://tinyurl.com/etwcentral](https://tinyurl.com/etwcentral)

> **🔧 VISION-ProcMon**
>
> **Link:** [https://github.com/forensicxlab/VISION-ProcMon](https://github.com/forensicxlab/VISION-ProcMon)
> 
> **What it does:** Rust + Tauri visualization for ProcMon output.
> 
> **Why it’s useful:**
> 
> - **Malware analysis focused**
> - Beautiful web-based visualization
> - Cross-platform (Tauri)
> - Designed for behavioral analysis

## TIER B — Built-in / Reference

> **🔬 Built-in Windows Commands**
>
> **Hidden gems most people don’t know:**
> 
> ```powershell
> # Quick process tree with parent info
> wmic process get processid,parentprocessid,commandline
> 
> # ETW providers list
> logman query providers
> 
> # ETW provider details
> logman query providers Microsoft-Windows-Kernel-Process
> 
> ```
> 
> **Event Log:** Event ID 4688 (Process Creation) — requires Audit Process Creation policy enabled.

> **🔬 ETWExplorer**
>
> Use for deep provider inspection — see what events and data each provider offers.
> 
> Referenced in multiple red team resources for understanding ETW capabilities.

* * *

# 🍎 macOS

## TIER S — The Hidden Gems

> **⭐ mac-monitor — 'The Missing ProcMon for macOS'**
>
> **Link:** [https://github.com/redcanaryco/mac-monitor](https://github.com/redcanaryco/mac-monitor)
> 
> **What it does:** Full Endpoint Security event monitoring with GUI.
> 
> **Why it’s a gem:**
> 
> - Made by **Red Canary** — real security company
> - **Process lineage subtree** — click any event, see the family tree
> - **Event correlation** — related events grouped together
> - Dynamic event subscriptions — modify what you’re watching on the fly
> - Path muting at API level
> - High fidelity ES events with enrichment (File Quarantine, code signing certs)
> - Exports to ESLogger-compatible JSON
> 
> **Requirements:**
> 
> - Apple Silicon recommended (Intel works)
> - Full Disk Access permission
> - System Extension approval
> 
> **Installation:** Download from [https://github.com/Brandon7CC/mac-monitor/releases](https://github.com/Brandon7CC/mac-monitor/releases)

> **⭐ eslogger — Already On Your Mac**
>
> **What it does:** Built-in Endpoint Security framework logger (macOS 13+).
> 
> **Why it’s a gem:**
> 
> - **No SIP disable needed**
> - **No extra software**
> - JSON output — pipe to `jq` for filtering
> - Works with Full Disk Access permission
> 
> **Usage:**
> 
> ```bash
> # List all executables launched
> sudo eslogger exec | jq -r '.event.exec.target.executable.path'
> 
> # Monitor files accessed by git
> sudo eslogger stat | jq -r 'select(.process.executable.path | test("/git$")) | .event.stat.target.path'
> 
> ```
> 
> **Note:** Apple doesn’t guarantee stable API — but it works great for research.

> **⭐ strace-macos**
>
> **Link:** [https://github.com/Mic92/strace-macos](https://github.com/Mic92/strace-macos)
> 
> **What it does:** strace clone for macOS.
> 
> **Why it’s a gem:**
> 
> - Finally, actual strace on Mac
> - Install via pipx: `env PIPX_DEFAULT_PYTHON='/usr/bin/python3' pipx install git+https://github.com/Mic92/strace-macos`

## TIER A — Solid Alternatives

> **🔧 esl**
>
> **Link:** [https://github.com/tstromberg/esl](https://github.com/tstromberg/esl)
> 
> **What it does:** Go library for consuming EndpointSecurity events via eslogger.
> 
> **Why it’s useful:**
> 
> - Programmatic access to eslogger
> - Example CLI included
> - Experimental but functional

> **🔧 esfriend**
>
> **Link:** [https://github.com/mcarmanize/esfriend](https://github.com/mcarmanize/esfriend)
> 
> **What it does:** Minimal malware analysis sandbox for macOS.
> 
> **Why it’s useful:**
> 
> - Uses eslogger for event collection
> - Designed for physical Mac as sandbox
> - Uses Faronics Deep Freeze for cleanup
> - Split exec/close events for accuracy

> **🔧 DTraceToolkit**
>
> **Link:** [https://www.brendangregg.com/dtrace.html](https://www.brendangregg.com/dtrace.html)
> 
> **What it does:** 200+ DTrace scripts by Brendan Gregg.
> 
> **Why it’s useful:**
> 
> - The OG observability toolkit
> - Scripts for process, I/O, network, everything
> - Many included in macOS by default
> 
> **Key scripts:**
> 
> ```bash
> # New processes with arguments
> sudo dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'
> 
> # Files opened by process
> sudo dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'
> 
> ```
> 
> **Note:** Requires SIP disabled for full functionality. Or use `eslogger` instead.

> **🔧 fs\_usage — Built-in**
>
> **What it does:** File system usage monitor.
> 
> **Usage:**
> 
> ```bash
> sudo fs_usage -w -f exec # Trace all exec calls
> 
> ```
> 
> Already installed on every Mac.

## TIER B — Reference

> **🔬 Endpoint Security Framework Deep Dive**
>
> **Wiki:** [https://github.com/redcanaryco/mac-monitor/wiki](https://github.com/redcanaryco/mac-monitor/wiki)
> 
> Covers:
> 
> - ES API internals
> - Client initialization
> - Event subscriptions
> - endpointsecurityd daemon analysis
> - Frida instrumentation techniques
> 
> **Required reading** if building ES-based tools.

* * *

# 🤖 ANDROID

## TIER A — The Main Tools

> **🔧 Frida — The Swiss Army Knife**
>
> **Link:** [https://frida.re/](https://frida.re/)
> 
> **What it does:** Dynamic instrumentation toolkit — inject scripts into running apps.
> 
> **Why it’s the standard:**
> 
> - Works on Android, iOS, Windows, macOS, Linux
> - `frida-ps -U` — list processes on USB device
> - `frida-trace -U -i open -N com.app` — trace function calls
> - Bypass root detection, SSL pinning
> - Massive community + script library: [https://codeshare.frida.re/](https://codeshare.frida.re/)
> 
> **Setup:**
> 
> ```bash
> # On computer
> pip install frida-tools
> 
> # On rooted Android device
> adb push frida-server /data/local/tmp/
> adb shell "chmod 755 /data/local/tmp/frida-server"
> adb shell "/data/local/tmp/frida-server &"
> 
> # Test
> frida-ps -U
> 
> ```
> 
> **Note:** Requires rooted device OR Frida Gadget injection for non-rooted.

> **🔧 android-trace**
>
> **Link:** [https://github.com/HayesGordon/android-trace](https://github.com/HayesGordon/android-trace)
> 
> **What it does:** Frida-node CLI wrapper for class/method tracing.
> 
> **Why it’s useful:**
> 
> - Easier than raw Frida for class enumeration
> - Filter by regex
> - JSON config for batch tracing
> 
> **Usage:**
> 
> ```bash
> node index.js -U -n com.app.package -F "com.app.package"
> 
> ```

> **🔧 strace for Android**
>
> **Links:**
> 
> - [https://github.com/hnw/strace-android-ndk](https://github.com/hnw/strace-android-ndk) (NDK build)
> - [https://github.com/xdbob/strace](https://github.com/xdbob/strace) (with Binder support)
> 
> **Why the Binder fork matters:** Android IPC uses Binder protocol. Stock strace doesn’t decode it. xdbob’s fork does.

## TIER B — Built-in Tools

> **🔬 ADB Built-in Commands**
>
> ```bash
> # See app launches (events log)
> adb logcat -b events | grep am_proc_start
> 
> # Process hierarchy and who started what
> adb shell dumpsys activity processes
> 
> # Basic parent-child relationships
> adb shell ps -A -o PID,PPID,NAME
> 
> # Get APK path
> adb shell pm path com.app.package
> 
> # Send input events
> adb shell input tap 500 500
> 
> ```

* * *

# 🌐 CROSS-PLATFORM / BONUS

> **🎨 r-top — Rust TUI with Shaders**
>
> **Link:** [https://github.com/asian-mario/r-top](https://github.com/asian-mario/r-top)
> 
> **What it does:** Process monitor/manager with visual effects.
> 
> **Platform:** Unix-like systems
> 
> **Why it’s cool:** Uses ratatui + tachyonfx for shader effects. Looks amazing.

> **🎨 rustnet-monitor**
>
> **Link:** [https://docs.rs/crate/rustnet-monitor/latest](https://docs.rs/crate/rustnet-monitor/latest)
> 
> **What it does:** Cross-platform network monitoring TUI.
> 
> **Platforms:** Linux (eBPF), macOS (getifaddrs), Windows (GetIfTable2)
> 
> **Features:**
> 
> - Real-time TCP/UDP/ICMP/ARP monitoring
> - Connection state tracking
> - Deep packet inspection
> - eBPF on Linux for low overhead

* * *

# 📊 FULL COMPARISON MATRIX

| Tool | Platform | Explains WHY | Real-time | No-root | eBPF/ETW | TUI/GUI | Process Tree | Debugger |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| **witr** | Linux/macOS | ✅ **BEST** | ❌ | ✅ | ❌ | ❌ | ✅ text | ❌ |
| **tracexec** | Linux | ⚠ raw | ✅ | ⚠ | ✅ | ✅ TUI | ❌ | ✅ |
| **extrace** | Linux | ⚠ raw | ✅ | ❌ | ❌ | ❌ | ✅ indent | ❌ |
| **execsnoop** | Linux | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
| **pspy** | Linux | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **forkstat** | Linux | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
| **strace-process-tree** | Linux | ❌ | ❌ post | ✅ | ❌ | ❌ | ✅ | ❌ |
| **visual-strace** | Linux | ❌ | ❌ post | ✅ | ❌ | ✅ web | ✅ graph | ❌ |
| **system\_monitor** | Windows | ⚠ raw | ✅ | ❌ | ✅ ETW | ❌ | ❌ | ❌ |
| **wtrace** | Windows | ⚠ raw | ✅ | ❌ | ✅ ETW | ❌ | ✅ summary | ❌ |
| **ProcMonX** | Windows | ⚠ raw | ✅ | ❌ | ✅ ETW | ✅ GUI | ✅ | ❌ |
| **mac-monitor** | macOS | ⚠ raw | ✅ | ❌ | ES API | ✅ GUI | ✅ | ❌ |
| **eslogger** | macOS | ❌ | ✅ | ❌ | ES API | ❌ | ❌ | ❌ |
| **Frida** | All | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |

**Legend:**

- ✅ = Yes
- ❌ = No
- ⚠ raw = Shows data but YOU interpret it (vs witr which explains)

* * *

# 🎯 STRATEGIC RECOMMENDATIONS

## Quick Reference: Which Tool For Which Job

| Situation | Linux | Windows | macOS | Android |
| --- | --- | --- | --- | --- |
| “Explain this process” | **witr** | — | **witr** | — |
| Watch everything live | **tracexec** | **wtrace** | **mac-monitor** | **Frida** |
| No admin/root access | **pspy** | — | — | — |
| Production monitoring | **execsnoop** | **system\_monitor** | **eslogger** | — |
| Post-mortem analysis | **strace-process-tree** | **VISION-ProcMon** | — | — |
| Visual graphs | **visual-strace** | **ProcMonX** | **mac-monitor** | — |
| Build custom tools | **bcc/bpftrace** | **krabsetw** | **esl** | **Frida** |

## Upgrade Path (Code Block)

```auto
QUICK CHECK: witr (Linux/Mac) — still the best for explanation synthesis
DEEP DEBUGGING: tracexec (Linux) | mac-monitor (macOS) | wtrace (Windows)
PRODUCTION: execsnoop (Linux eBPF) | system_monitor (Windows ETW)
NO ROOT: pspy (Linux) | eslogger (macOS)
VISUALIZATION: visual-strace (browser) | strace-process-tree (CLI)
MOBILE: Frida (Android/iOS)

```

* * *

# 🔮 WHAT DOESN’T EXIST YET (Project Ideas)

These tools would complete the ecosystem but **nobody’s built them:**

| Gap | Description | Difficulty |
| --- | --- | --- |
| **Cross-platform witr** | Same “explain why” synthesis on Windows/macOS | Medium |
| **Historical explainer** | “Why was this running at 3am?” using audit logs | Hard |
| **Package-aware identifier** | “This is nginx from apt” or “node from nvm” | Medium |
| **AI process explainer** | LLM summarizing process chains into plain English | Easy-Medium |
| **Unified timeline** | Merge events from multiple tools into single view | Hard |

**Free startup ideas. You’re welcome.**

* * *

# 📋 VALIDATION: Why This List Is Different

**How we know these are real gems:**

- ✅ Not page-1 Google results
- ✅ Posted by practitioners (kxxt, leahneukirchen, Brendan Gregg, Colin Ian King, Pavel Yosifovich)
- ✅ All have working binaries/packages
- ✅ Provides actual leverage (debugging, security, forensics)
- ✅ “Where tf did you find this?” factor
- ✅ Beginners don’t stumble on these accidentally

**Failed search paths (so you don’t waste time):**

- “process ancestry” → returns genealogy software (Gramps, GEDCOM)
- “Linux process monitor” → returns top/htop tutorials
- “systemd process origin” → returns GitHub issues, not tools
- Generic Rust/Go process spawn searches → language stdlib issues

* * *

# 🔗 MASTER LINK LIST

## Linux

| Tool | Link |
| --- | --- |
| witr | [https://github.com/pranshuparmar/witr](https://github.com/pranshuparmar/witr) |
| tracexec | [https://github.com/kxxt/tracexec](https://github.com/kxxt/tracexec) |
| extrace | [https://github.com/leahneukirchen/extrace](https://github.com/leahneukirchen/extrace) |
| pspy | [https://github.com/DominicBreuker/pspy](https://github.com/DominicBreuker/pspy) |
| execsnoop (bcc) | [https://github.com/iovisor/bcc](https://github.com/iovisor/bcc) |
| execsnoop (bpftrace) | [https://github.com/bpftrace/bpftrace](https://github.com/bpftrace/bpftrace) |
| forkstat | `apt install forkstat` |
| strace-process-tree | [https://github.com/mgedmin/strace-process-tree](https://github.com/mgedmin/strace-process-tree) |
| visual-strace | [https://github.com/lhoursquentin/visual-strace](https://github.com/lhoursquentin/visual-strace) |
| ProcMon-for-Linux | [https://github.com/microsoft/ProcMon-for-Linux](https://github.com/microsoft/ProcMon-for-Linux) |
| strace-parser | [https://gitlab.com/gitlab-com/support/toolbox/strace-parser](https://gitlab.com/gitlab-com/support/toolbox/strace-parser) |
| opentelemetry-ebpf-profiler | [https://github.com/open-telemetry/opentelemetry-ebpf-profiler](https://github.com/open-telemetry/opentelemetry-ebpf-profiler) |
| redcanary-ebpf-sensor | [https://github.com/redcanaryco/redcanary-ebpf-sensor](https://github.com/redcanaryco/redcanary-ebpf-sensor) |
| dockerfileview | [https://github.com/remore/dockerfileview](https://github.com/remore/dockerfileview) |

## Windows

| Tool | Link |
| --- | --- |
| system\_monitor | [https://github.com/wuanzhuan/system\_monitor](https://github.com/wuanzhuan/system_monitor) |
| wtrace | [https://github.com/lowleveldesign/wtrace](https://github.com/lowleveldesign/wtrace) |
| ferrisetw | [https://github.com/n4r1b/ferrisetw](https://github.com/n4r1b/ferrisetw) |
| krabsetw | [https://github.com/microsoft/krabsetw](https://github.com/microsoft/krabsetw) |
| ProcMonX | [https://github.com/zodiacon/ProcMonX](https://github.com/zodiacon/ProcMonX) |
| ProcMonXv2 | [https://github.com/zodiacon/ProcMonXv2](https://github.com/zodiacon/ProcMonXv2) |
| PowerKrabsEtw | [https://github.com/zacbrown/PowerKrabsEtw](https://github.com/zacbrown/PowerKrabsEtw) |
| UIforETW | [https://github.com/google/UIforETW](https://github.com/google/UIforETW) |
| VISION-ProcMon | [https://github.com/forensicxlab/VISION-ProcMon](https://github.com/forensicxlab/VISION-ProcMon) |

## macOS

| Tool | Link |
| --- | --- |
| mac-monitor | [https://github.com/redcanaryco/mac-monitor](https://github.com/redcanaryco/mac-monitor) |
| eslogger | Built-in (macOS 13+) |
| strace-macos | [https://github.com/Mic92/strace-macos](https://github.com/Mic92/strace-macos) |
| esl | [https://github.com/tstromberg/esl](https://github.com/tstromberg/esl) |
| esfriend | [https://github.com/mcarmanize/esfriend](https://github.com/mcarmanize/esfriend) |
| DTraceToolkit | [https://www.brendangregg.com/dtrace.html](https://www.brendangregg.com/dtrace.html) |

## Android

| Tool | Link |
| --- | --- |
| Frida | [https://frida.re/](https://frida.re/) |
| android-trace | [https://github.com/HayesGordon/android-trace](https://github.com/HayesGordon/android-trace) |
| strace-android-ndk | [https://github.com/hnw/strace-android-ndk](https://github.com/hnw/strace-android-ndk) |
| strace (Binder) | [https://github.com/xdbob/strace](https://github.com/xdbob/strace) |

## Cross-Platform

| Tool | Link |
| --- | --- |
| r-top | [https://github.com/asian-mario/r-top](https://github.com/asian-mario/r-top) |
| rustnet-monitor | [https://docs.rs/crate/rustnet-monitor/latest](https://docs.rs/crate/rustnet-monitor/latest) |

* * *

**Your computer’s been keeping secrets. Now you have the tools to read its diary.** 🔓

---

<div class="post-metadata">

**Author:** ![Emanuel\_Branson](https://onehack.st/user_avatar/onehack.st/emanuel_branson/32/178452_2.png) [@Emanuel\_Branson](https://onehack.st/u/Emanuel_Branson)\
**Post date:** [January 25, 2026, 5:00pm UTC](https://onehack.st/t/40-tools-to-see-why-processes-run-see-everything-your-os-hides/317367/2 "2026-01-25T17:00:34Z")

</div>

Thank you for the marvelous share @SRZ as always.