#Linux process monitor tool 64 Bit#
#Linux process monitor tool 32 bit#
#Linux process monitor tool password#

In this example, you find a process with PID 23 which seems to change the password of myuser. When pspy detects a new process, it adds a line to this log. ~/pspy (master) $ make example docker run -it -rm local/pspy-example:latest cron started Running as user uid=1000(myuser) gid=1000(myuser) groups=1000(myuser),27(sudo) Starting pspy now. Watching files inside /usr is most important since many tools will access libraries inside it. The default settings should be fine for most applications. -debug: prints verbose error messages which are otherwise hidden.File system events are not colored anymore, commands have different colors based on process UID. -c: print commands in different colors.pspy scans regularly for new processes regardless of Inotify events, just in case some events are not received. -i: interval in milliseconds between procfs scans.pspy will watch these directories only, not the subdirectories (empty by default). -d: list of directories to watch with Inotify.

pspy will watch all subdirectories recursively (by default, watches /usr, /tmp, /etc, /home, /var, and /opt). -r: list of directories to watch with Inotify.-f: enables printing file system events to stdout (disabled by default).-p: enables printing commands to stdout (enabled by default).You can run pspy -help to learn about the flags and their meaning. BuildĮither use Go installed on your system or run the Docker-based build process which ran to create the release.įor the latter, ensure Docker is installed, and then run make build-build-image to build a Docker image, followed by make build to build the binaries with it. If size is an issue, try the smaller versions which depend on libc and are compressed with UPX (~1MB). The statically compiled files should work on any Linux system but are quite huge (~4MB).

#Linux process monitor tool 64 Bit#

64 bit big, static version: pspy64 download.

#Linux process monitor tool 32 bit#

32 bit big, static version: psp圓2 download.

Get the tool onto the Linux machine you want to inspect.įirst get the binaries. Inotify watchers placed on selected parts of the file system trigger these scans to catch short-lived processes. The tool gathers the info from procfs scans. Great for enumeration of Linux systems in CTFs.Īlso great to demonstrate your colleagues why passing secrets as arguments on the command line is a bad idea. It allows you to see commands run by other users, cron jobs, etc. Pspy is a command line tool designed to snoop on processes without need for root permissions. Pspy - unprivileged Linux process snooping