Hacker News new | ask | show | jobs
by bboreham 1872 days ago
Original ProcMon used ETW, Event Tracing for Windows; the analogous technology (although very different in style) on Linux is eBPF so that’s what this tool uses.
1 comments
altano 1872 days ago
I think you’re mistaken. ProcMon doesn’t use ETW on Windows and I don’t believe it ever did?
link
bboreham 1871 days ago
Sorry about that; I guess I misremembered?

This file says it does, though only for network events: https://documentation.help/Process-Monitor/documentation.pdf

link
ale42 1872 days ago
Indeed I don't think so. ProcMon uses a kernel driver for the event tracing.
link