
Unfortunately, Procmon cannot be compiled under WSL due to the lack of Kernel event tracing. Run the following commands: wget -q $(lsb_release -rs)/b -O b Installation instructions on Ubuntu 18.04 devices are straightforward. Microsoft plans to add more configurations to the system requirements in the future to take these systems into account.
Several users tried to build or install the process monitor tool on Ubuntu 20.04 systems and failed. Since it is released as a preview, it is limited to systems running Ubuntu 18.04 with kernel 4.18 up to 5.3 at the time of writing. Microsoft is also making available a Debian/Ubuntu package of this preview build. Microsoft released the source code to their Procmon Linux version and is marked as a 1.0 preview release. f/-file FILEPATH Open a Procmon trace file c/-collect Option to start Procmon in a headless mode e/-events Comma separated list of system calls to monitor p/-pids Comma separated list of process ids to monitor When using it, you can specify the process IDs that you would like to monitor or specific system calls using the following arguments: Usage: procmon Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system. The Procmon is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows.

On the official GitHub page for the project, Microsoft explains:


Filtering of processes is optionally done on command name, ranging from absolute to fuzzy. This week Microsoft has released a Linux version of the popular Procmon utility that Linux users can monitor running processes.Ībove all, this application scans the table of running processes, killing those that has exceeds a given CPU-time limit or has gone for lunch. Procmon is a Windows utility that monitors the system calls, Registry access, and file activity for processes running in the operating system.
