Sysinternals for Linux
summary
Ports of Sysinternals tools for Linux deliver concrete capabilities: sysmon (process create/exit, TCP/UDP connections, file create/delete, service/config changes, ptrace and raw block access) implemented via eBPF and emitting XML to syslog; procmon is an interactive syscall TUI with per-call stacks, filters and SQLite export; procdump creates core dumps on triggers (CPU, memory, threads, fds, signals) and uses .NET runtime integration to produce much smaller managed dumps. Tools use BCC or libbpf, support kernels back to ~4.15 with raw tracepoints from 4.17, include offsets fallback (config, offsets DB, memory discovery) and are open source on GitHub.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 2:39Sysinternals for Linux overview
- 5:09Sysmon for Linux introduction
- 9:52Sysmon for Linux demo
- 14:09Procmon and Procdump for Linux
- 16:47Procmon demo
- 20:20Procdump demo
- 26:23eBPF deep dive
- 49:49Sysmon event generation with eBPF
- 57:32Licensing and future plans
- 58:13Procmon and Procdump roadmap
- 1:00:20Resources and closing
