40+ Tools To See WHY Processes Run — 👁️ See Everything Your OS Hides

Tools & Scripts
, ,
1

:hole: The “Why Is This Running?” Rabbit Hole — Every Tool The Pros Use To See What’s REALLY Happening On Your Machine

One question changed everything: “What if I could ask my computer WHY something is running — not just WHAT?”

:world_map: The Full Excavation — 40+ Tools Across Every Platform, Ranked By Rarity

Someone dropped witr (Why Is This Running) in conversation. We went digging. Five tiers deep. Found tools security researchers gatekeep. Tools that don’t show up on page 1. Tools where you ask “where tf did you find this?”

Why this matters to YOU:

  • :shield: Malware hides as “svchost.exe” or “system” — these tools expose the family tree
  • :money_with_wings: Your slow computer? Something’s eating resources. Find it in seconds.
  • :unlocked: Pentesters, CTF players, sysadmins — this is your cheat sheet

What you’re getting:

  • :white_check_mark: Every platform covered (Linux, Windows, macOS, Android)
  • :white_check_mark: TIER rankings (S/A/B) — skip the mid tools
  • :white_check_mark: “Why It’s a Gem” breakdown for each
  • :white_check_mark: Comparison matrix so you pick the right one
  • :white_check_mark: Strategic recommendations from actual usage
  • :white_check_mark: Project ideas nobody’s built yet (free alpha)

:penguin: LINUX

TIER S — The Hidden Gems

⭐ witr (Why Is This Running) — THE GOLD STANDARD

Link: https://github.com/pranshuparmar/witr

What it does: Give it a PID, port, or process name → get a human-readable explanation of the ENTIRE causal chain.

Why it’s a gem:

  • Instead of seeing node you see: systemd → pm2 → node (running /home/you/app)
  • Shows git repo, working directory, warnings
  • Synthesizes information into actual sentences — no other tool does this
  • Works on Linux + basic macOS support

The magic: Every other tool gives you RAW DATA. witr gives you an EXPLANATION.

Example output:

Process: node (PID 12847)
Started by: pm2 (process manager)
Which was started by: systemd (system service)
Working directory: /home/user/myproject
Git repo: https://github.com/user/myproject

No other tool talks to you like this.

⭐ tracexec — The Power User's Weapon

Link: https://github.com/kxxt/tracexec

What it does: Traces every execve syscall (program launch) with a beautiful TUI.

Why it’s a gem:

  • Written in Rust — fast af, single binary
  • TUI mode — watch exec events + interact with pseudo-terminal
  • eBPF mode (kernel 5.17+) — ultra-low overhead
  • ptrace fallback — works on older kernels, handles setuid binaries
  • Shows environment variable diffs between parent/child
  • Shows file descriptor changes
  • Can launch a debugger (gdb) attached to spawned processes mid-execution
  • Built by a practitioner debugging build systems

Use case: Trace what a shell script ACTUALLY executes. Attach debugger to subprocess in complex pipeline.

Installation:

cargo install tracexec
# OR download binary from releases
⭐ extrace — Minimalist Perfection

Link: https://github.com/leahneukirchen/extrace

What it does: Traces ALL exec() calls system-wide using Netlink connector.

Why it’s a gem:

  • Written by Void Linux maintainer (leahneukirchen) — practitioner credibility
  • Hierarchy indentation shows parent-child relationships visually
  • Pure C, minimal dependencies
  • Options: -d (cwd), -e (env), -t (exit status + duration), -u (user), -l (full path)
  • Can trace descendants of specific PID only

Example:

sudo extrace -d -t
# Shows every exec with working directory and how long it ran

Requires: CAP_NET_ADMIN or root

⭐ pspy — NO ROOT REQUIRED

Link: https://github.com/DominicBreuker/pspy

What it does: Monitors processes WITHOUT root access using inotify + procfs scanning.

Why it’s a gem:

  • CTF and pentest favorite — works when you can’t get root
  • Catches short-lived processes that ps misses
  • Shows commands run by OTHER USERS
  • Catches cron jobs and scheduled tasks
  • Single binary — just download and run

Flags:

  • -p print commands
  • -f filesystem events
  • -i scan interval

Binary releases: pspy32, pspy64 — no compilation needed

Use case: You’re on a box with limited privs. What’s running? Who’s running it? pspy knows.

⭐ execsnoop (BCC/bpftrace) — Brendan Gregg's Classic

Link: https://github.com/iovisor/bcc (execsnoop.py) | https://github.com/bpftrace/bpftrace (execsnoop.bt)

What it does: eBPF-powered tracing of execve() syscall.

Why it’s a gem:

  • Created by Brendan Gregg — the observability god
  • <1% overhead — safe for production
  • Part of bcc-tools package
  • Shows PID, PPID, return value, full command + args
  • Can filter by process name or failed execs

Installation:

apt install bpfcc-tools  # Debian/Ubuntu
# Then run:
execsnoop-bpfcc

TIER A — Solid Complements

🔧 forkstat

What it does: Netlink-based tracker for fork/exec/exit/clone/comm/uid/sid events.

Why it’s useful:

  • Shows parent PID → child PID with process names
  • Logs process duration on exit
  • Maintained by Colin Ian King (Ubuntu kernel team)

Installation:

apt install forkstat  # Debian/Ubuntu
yum install forkstat  # RHEL/CentOS

Requires: root or CAP_NET_ADMIN

🔧 strace-process-tree

Link: https://github.com/mgedmin/strace-process-tree

What it does: Reads strace -f output and produces a visual process tree.

Why it’s useful:

  • Post-mortem analysis — run strace, analyze later
  • Beautiful ASCII tree output showing fork/exec relationships
  • Pipe-friendly

Usage:

strace -f -e trace=process -s 1024 -o /tmp/trace.out make build
strace-process-tree /tmp/trace.out

Output example:

25510 make binary-package
├─25511 /bin/sh -c 'dpkg-parsechangelog...'
│ ├─25512 dpkg-parsechangelog
│ │ └─25514 tail -n 40 debian/changelog
│ └─25513 awk '$1 == "Source:" { print $2 }'
🔧 visual-strace — Browser-Based Visualization

Link: https://github.com/lhoursquentin/visual-strace

What it does: In-browser visual representation of strace output using cytoscape.js graphs.

Why it’s useful:

  • Visual graph — not just text
  • Shows forks, execves, pipes, exit status
  • Color-coded: green (success), red (non-zero exit), purple (signal death)
  • Orange arrows show read/write relationships between processes

Try it: https://lhoursquentin.github.io/visual-strace/

🔧 Microsoft ProcMon-for-Linux

Link: https://github.com/microsoft/ProcMon-for-Linux

What it does: Official Linux port of Sysinternals Process Monitor.

Why it’s useful:

  • Familiar interface for Windows users
  • TUI included
  • Traces syscall activity
  • Can output to file for later analysis

Usage:

sudo procmon  # TUI mode
sudo procmon -c /tmp/trace.db  # Headless mode
🔧 strace-parser (GitLab)

Link: https://gitlab.com/gitlab-com/support/toolbox/strace-parser

What it does: Summarizes strace output with per-PID statistics.

Why it’s useful:

  • Built by GitLab Support for debugging Gitaly/Unicorn
  • More detailed than strace -c
  • Shows parent/child process breakdown
  • Practitioner tool — battle-tested

TIER B — Specialized/Forensics

🔬 opentelemetry-ebpf-profiler

Link: https://github.com/open-telemetry/opentelemetry-ebpf-profiler

What it does: Whole-system cross-language profiler.

Why it’s useful:

  • Profiles C/C++, Go, Rust, Python, Java, Node, .NET, PHP, Ruby, Perl
  • 1% CPU overhead, ~250MB memory
  • Mixed stacktraces from kernel → system libs → high-level language
  • No debug symbols required
  • CO-RE (works across kernel versions)
🔬 redcanary-ebpf-sensor

Link: https://github.com/redcanaryco/redcanary-ebpf-sensor

What it does: Security-focused BPF programs for kernel event collection.

Why it’s useful:

  • Gathers process lineage, network connections, file access
  • Selectively loads probes based on kernel version
  • Made by Red Canary (legit security company)
🔬 dockerfileview

Link: https://github.com/remore/dockerfileview

What it does: Traces Docker image ancestry.

Why it’s useful:

  • See the full Dockerfile chain from base image to current
  • dockerfileview nginx:1.9.2 reveals all FROM layers

:window: WINDOWS

TIER S — The Hidden Gems

⭐ wuanzhuan/system_monitor — Rust ETW Procmon Replacement

Link: https://github.com/wuanzhuan/system_monitor

What it does: Windows kernel event monitoring via ETW, written in Rust.

Why it’s a gem:

  • Literal procmon replacement — the description says it
  • More events and better filtering than original
  • Handle leak detection — can run for WEEKS tracking leaks
  • Rust = memory safe, fast, modern

Use case: Debug handle leaks that only manifest after days of runtime. Original ProcMon can’t do this reliably.

⭐ wtrace — Single Binary CLI Power

Link: https://github.com/lowleveldesign/wtrace

What it does: Command-line ETW tracing tool.

Why it’s a gem:

  • Single .exe file — no install
  • Traces file I/O, registry, network, RPC calls
  • Process tree in summary — shows hierarchy at end of session
  • Can trace specific process + all children with -c
  • Resolves RPC procedure names
  • Works on Windows 8.1+

Installation:

choco install wtrace
# OR download from GitHub releases

Usage:

wtrace notepad c:\temp\test.txt  # Start and trace
wtrace -c 1234                    # Trace PID and children
wtrace --handlers file -f 'eventname=FileIO/Write'  # Filter
⭐ ferrisetw — Rust KrabsETW

Link: https://github.com/n4r1b/ferrisetw

What it does: Rust library for ETW consumption.

Why it’s a gem:

  • Started as KrabsETW port, now diverging with Rust idioms
  • Full ETW provider support
  • Proper Rust error handling
  • Actively maintained
  • Credits Microsoft’s KrabsETW team

Use case: Building your own Rust-based monitoring tools on Windows.

TIER A — Solid Alternatives

🔧 krabsetw (Microsoft Official)

Link: https://github.com/microsoft/krabsetw

What it does: Modern C++ and .NET wrapper for ETW.

Why it’s useful:

  • Made by Microsoft (Office 365 Security team)
  • Production-proven
  • Called “Lobsters” internally
  • NuGet packages available

Use case: Building enterprise monitoring tools in C++ or .NET.

🔧 ProcMonX / ProcMonXv2

Link: https://github.com/zodiacon/ProcMonX | https://github.com/zodiacon/ProcMonXv2

What it does: Extended Process Monitor using ETW instead of kernel driver.

Why it’s useful:

  • No kernel driver needed — ETW only
  • Made by Pavel Yosifovich (Windows Internals expert)
  • GUI interface
  • v2 is the newer version
🔧 PowerKrabsEtw

Link: https://github.com/zacbrown/PowerKrabsEtw

What it does: PowerShell interface for real-time ETW tracing.

Why it’s useful:

  • Trace-KrabsEtwProcess — like ProcMon for specific process
  • Create custom providers, filters, traces
  • PowerShell-native (no compiled binaries needed for basic use)

Note: Start PowerShell with -MTA flag.

🔧 UIforETW (Google)

Link: https://github.com/google/UIforETW

What it does: User interface for recording and managing ETW traces.

Why it’s useful:

  • Made by Google — used for Chrome performance
  • Works around bugs in Windows Performance Toolkit
  • Records additional context (user input, CPU temp)
  • Fixes symbol loading issues
  • Categorizes Chrome processes automatically

Tutorials: https://tinyurl.com/etwcentral

🔧 VISION-ProcMon

Link: https://github.com/forensicxlab/VISION-ProcMon

What it does: Rust + Tauri visualization for ProcMon output.

Why it’s useful:

  • Malware analysis focused
  • Beautiful web-based visualization
  • Cross-platform (Tauri)
  • Designed for behavioral analysis

TIER B — Built-in / Reference

🔬 Built-in Windows Commands

Hidden gems most people don’t know:

# Quick process tree with parent info
wmic process get processid,parentprocessid,commandline

# ETW providers list
logman query providers

# ETW provider details
logman query providers Microsoft-Windows-Kernel-Process

Event Log: Event ID 4688 (Process Creation) — requires Audit Process Creation policy enabled.

🔬 ETWExplorer

Use for deep provider inspection — see what events and data each provider offers.

Referenced in multiple red team resources for understanding ETW capabilities.

:red_apple: macOS

TIER S — The Hidden Gems

⭐ mac-monitor — 'The Missing ProcMon for macOS'

Link: https://github.com/redcanaryco/mac-monitor

What it does: Full Endpoint Security event monitoring with GUI.

Why it’s a gem:

  • Made by Red Canary — real security company
  • Process lineage subtree — click any event, see the family tree
  • Event correlation — related events grouped together
  • Dynamic event subscriptions — modify what you’re watching on the fly
  • Path muting at API level
  • High fidelity ES events with enrichment (File Quarantine, code signing certs)
  • Exports to ESLogger-compatible JSON

Requirements:

  • Apple Silicon recommended (Intel works)
  • Full Disk Access permission
  • System Extension approval

Installation: Download from https://github.com/Brandon7CC/mac-monitor/releases

⭐ eslogger — Already On Your Mac

What it does: Built-in Endpoint Security framework logger (macOS 13+).

Why it’s a gem:

  • No SIP disable needed
  • No extra software
  • JSON output — pipe to jq for filtering
  • Works with Full Disk Access permission

Usage:

# List all executables launched
sudo eslogger exec | jq -r '.event.exec.target.executable.path'

# Monitor files accessed by git
sudo eslogger stat | jq -r 'select(.process.executable.path | test("/git$")) | .event.stat.target.path'

Note: Apple doesn’t guarantee stable API — but it works great for research.

⭐ strace-macos

Link: https://github.com/Mic92/strace-macos

What it does: strace clone for macOS.

Why it’s a gem:

  • Finally, actual strace on Mac
  • Install via pipx: env PIPX_DEFAULT_PYTHON='/usr/bin/python3' pipx install git+https://github.com/Mic92/strace-macos

TIER A — Solid Alternatives

🔧 esl

Link: https://github.com/tstromberg/esl

What it does: Go library for consuming EndpointSecurity events via eslogger.

Why it’s useful:

  • Programmatic access to eslogger
  • Example CLI included
  • Experimental but functional
🔧 esfriend

Link: https://github.com/mcarmanize/esfriend

What it does: Minimal malware analysis sandbox for macOS.

Why it’s useful:

  • Uses eslogger for event collection
  • Designed for physical Mac as sandbox
  • Uses Faronics Deep Freeze for cleanup
  • Split exec/close events for accuracy
🔧 DTraceToolkit

Link: https://www.brendangregg.com/dtrace.html

What it does: 200+ DTrace scripts by Brendan Gregg.

Why it’s useful:

  • The OG observability toolkit
  • Scripts for process, I/O, network, everything
  • Many included in macOS by default

Key scripts:

# New processes with arguments
sudo dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'

# Files opened by process
sudo dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'

Note: Requires SIP disabled for full functionality. Or use eslogger instead.

🔧 fs_usage — Built-in

What it does: File system usage monitor.

Usage:

sudo fs_usage -w -f exec  # Trace all exec calls

Already installed on every Mac.

TIER B — Reference

🔬 Endpoint Security Framework Deep Dive

Wiki: https://github.com/redcanaryco/mac-monitor/wiki

Covers:

  • ES API internals
  • Client initialization
  • Event subscriptions
  • endpointsecurityd daemon analysis
  • Frida instrumentation techniques

Required reading if building ES-based tools.

:robot: ANDROID

TIER A — The Main Tools

🔧 Frida — The Swiss Army Knife

Link: https://frida.re/

What it does: Dynamic instrumentation toolkit — inject scripts into running apps.

Why it’s the standard:

  • Works on Android, iOS, Windows, macOS, Linux
  • frida-ps -U — list processes on USB device
  • frida-trace -U -i open -N com.app — trace function calls
  • Bypass root detection, SSL pinning
  • Massive community + script library: https://codeshare.frida.re/

Setup:

# On computer
pip install frida-tools

# On rooted Android device
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"

# Test
frida-ps -U

Note: Requires rooted device OR Frida Gadget injection for non-rooted.

🔧 android-trace

Link: https://github.com/HayesGordon/android-trace

What it does: Frida-node CLI wrapper for class/method tracing.

Why it’s useful:

  • Easier than raw Frida for class enumeration
  • Filter by regex
  • JSON config for batch tracing

Usage:

node index.js -U -n com.app.package -F "com.app.package"
🔧 strace for Android

Links:

Why the Binder fork matters: Android IPC uses Binder protocol. Stock strace doesn’t decode it. xdbob’s fork does.

TIER B — Built-in Tools

🔬 ADB Built-in Commands 
# See app launches (events log)
adb logcat -b events | grep am_proc_start

# Process hierarchy and who started what
adb shell dumpsys activity processes

# Basic parent-child relationships
adb shell ps -A -o PID,PPID,NAME

# Get APK path
adb shell pm path com.app.package

# Send input events
adb shell input tap 500 500

:globe_with_meridians: CROSS-PLATFORM / BONUS

🎨 r-top — Rust TUI with Shaders

Link: https://github.com/asian-mario/r-top

What it does: Process monitor/manager with visual effects.

Platform: Unix-like systems

Why it’s cool: Uses ratatui + tachyonfx for shader effects. Looks amazing.

🎨 rustnet-monitor

Link: https://docs.rs/crate/rustnet-monitor/latest

What it does: Cross-platform network monitoring TUI.

Platforms: Linux (eBPF), macOS (getifaddrs), Windows (GetIfTable2)

Features:

  • Real-time TCP/UDP/ICMP/ARP monitoring
  • Connection state tracking
  • Deep packet inspection
  • eBPF on Linux for low overhead

:bar_chart: FULL COMPARISON MATRIX

Tool Platform Explains WHY Real-time No-root eBPF/ETW TUI/GUI Process Tree Debugger
witr Linux/macOS :white_check_mark: BEST :cross_mark: :white_check_mark: :cross_mark: :cross_mark: :white_check_mark: text :cross_mark:
tracexec Linux :warning: raw :white_check_mark: :warning: :white_check_mark: :white_check_mark: TUI :cross_mark: :white_check_mark:
extrace Linux :warning: raw :white_check_mark: :cross_mark: :cross_mark: :cross_mark: :white_check_mark: indent :cross_mark:
execsnoop Linux :cross_mark: :white_check_mark: :cross_mark: :white_check_mark: :cross_mark: :cross_mark: :cross_mark:
pspy Linux :cross_mark: :white_check_mark: :white_check_mark: :cross_mark: :cross_mark: :cross_mark: :cross_mark:
forkstat Linux :cross_mark: :white_check_mark: :cross_mark: :cross_mark: :cross_mark: :cross_mark: :cross_mark:
strace-process-tree Linux :cross_mark: :cross_mark: post :white_check_mark: :cross_mark: :cross_mark: :white_check_mark: :cross_mark:
visual-strace Linux :cross_mark: :cross_mark: post :white_check_mark: :cross_mark: :white_check_mark: web :white_check_mark: graph :cross_mark:
system_monitor Windows :warning: raw :white_check_mark: :cross_mark: :white_check_mark: ETW :cross_mark: :cross_mark: :cross_mark:
wtrace Windows :warning: raw :white_check_mark: :cross_mark: :white_check_mark: ETW :cross_mark: :white_check_mark: summary :cross_mark:
ProcMonX Windows :warning: raw :white_check_mark: :cross_mark: :white_check_mark: ETW :white_check_mark: GUI :white_check_mark: :cross_mark:
mac-monitor macOS :warning: raw :white_check_mark: :cross_mark: ES API :white_check_mark: GUI :white_check_mark: :cross_mark:
eslogger macOS :cross_mark: :white_check_mark: :cross_mark: ES API :cross_mark: :cross_mark: :cross_mark:
Frida All :cross_mark: :white_check_mark: :cross_mark: :cross_mark: :cross_mark: :cross_mark: :white_check_mark:

Legend:

  • :white_check_mark: = Yes
  • :cross_mark: = No
  • :warning: raw = Shows data but YOU interpret it (vs witr which explains)

:bullseye: STRATEGIC RECOMMENDATIONS

Quick Reference: Which Tool For Which Job

Situation Linux Windows macOS Android
“Explain this process” witr — witr —
Watch everything live tracexec wtrace mac-monitor Frida
No admin/root access pspy — — —
Production monitoring execsnoop system_monitor eslogger —
Post-mortem analysis strace-process-tree VISION-ProcMon — —
Visual graphs visual-strace ProcMonX mac-monitor —
Build custom tools bcc/bpftrace krabsetw esl Frida

Upgrade Path (Code Block)

QUICK CHECK:      witr (Linux/Mac) — still the best for explanation synthesis
DEEP DEBUGGING:   tracexec (Linux) | mac-monitor (macOS) | wtrace (Windows)
PRODUCTION:       execsnoop (Linux eBPF) | system_monitor (Windows ETW)
NO ROOT:          pspy (Linux) | eslogger (macOS)
VISUALIZATION:    visual-strace (browser) | strace-process-tree (CLI)
MOBILE:           Frida (Android/iOS)

:crystal_ball: WHAT DOESN’T EXIST YET (Project Ideas)

These tools would complete the ecosystem but nobody’s built them:

Gap Description Difficulty
Cross-platform witr Same “explain why” synthesis on Windows/macOS Medium
Historical explainer “Why was this running at 3am?” using audit logs Hard
Package-aware identifier “This is nginx from apt” or “node from nvm” Medium
AI process explainer LLM summarizing process chains into plain English Easy-Medium
Unified timeline Merge events from multiple tools into single view Hard

Free startup ideas. You’re welcome.

:clipboard: VALIDATION: Why This List Is Different

How we know these are real gems:

  • :white_check_mark: Not page-1 Google results
  • :white_check_mark: Posted by practitioners (kxxt, leahneukirchen, Brendan Gregg, Colin Ian King, Pavel Yosifovich)
  • :white_check_mark: All have working binaries/packages
  • :white_check_mark: Provides actual leverage (debugging, security, forensics)
  • :white_check_mark: “Where tf did you find this?” factor
  • :white_check_mark: Beginners don’t stumble on these accidentally

Failed search paths (so you don’t waste time):

  • “process ancestry” → returns genealogy software (Gramps, GEDCOM)
  • “Linux process monitor” → returns top/htop tutorials
  • “systemd process origin” → returns GitHub issues, not tools
  • Generic Rust/Go process spawn searches → language stdlib issues

:link: MASTER LINK LIST

Linux

Tool Link
witr https://github.com/pranshuparmar/witr
tracexec https://github.com/kxxt/tracexec
extrace https://github.com/leahneukirchen/extrace
pspy https://github.com/DominicBreuker/pspy
execsnoop (bcc) https://github.com/iovisor/bcc
execsnoop (bpftrace) https://github.com/bpftrace/bpftrace
forkstat apt install forkstat
strace-process-tree https://github.com/mgedmin/strace-process-tree
visual-strace https://github.com/lhoursquentin/visual-strace
ProcMon-for-Linux https://github.com/microsoft/ProcMon-for-Linux
strace-parser https://gitlab.com/gitlab-com/support/toolbox/strace-parser
opentelemetry-ebpf-profiler https://github.com/open-telemetry/opentelemetry-ebpf-profiler
redcanary-ebpf-sensor https://github.com/redcanaryco/redcanary-ebpf-sensor
dockerfileview https://github.com/remore/dockerfileview

Windows

Tool Link
system_monitor https://github.com/wuanzhuan/system_monitor
wtrace https://github.com/lowleveldesign/wtrace
ferrisetw https://github.com/n4r1b/ferrisetw
krabsetw https://github.com/microsoft/krabsetw
ProcMonX https://github.com/zodiacon/ProcMonX
ProcMonXv2 https://github.com/zodiacon/ProcMonXv2
PowerKrabsEtw https://github.com/zacbrown/PowerKrabsEtw
UIforETW https://github.com/google/UIforETW
VISION-ProcMon https://github.com/forensicxlab/VISION-ProcMon

macOS

Tool Link
mac-monitor https://github.com/redcanaryco/mac-monitor
eslogger Built-in (macOS 13+)
strace-macos https://github.com/Mic92/strace-macos
esl https://github.com/tstromberg/esl
esfriend https://github.com/mcarmanize/esfriend
DTraceToolkit https://www.brendangregg.com/dtrace.html

Android

Tool Link
Frida https://frida.re/
android-trace https://github.com/HayesGordon/android-trace
strace-android-ndk https://github.com/hnw/strace-android-ndk
strace (Binder) https://github.com/xdbob/strace

Cross-Platform

Tool Link
r-top https://github.com/asian-mario/r-top
rustnet-monitor https://docs.rs/crate/rustnet-monitor/latest

Your computer’s been keeping secrets. Now you have the tools to read its diary. :unlocked:

11 лайков
2

Thank you for the marvelous share @SRZ as always.

2 лайка