tracebyte8/linux-syscall-monitor

Linux Syscall Monitor is a small command line tool written in C that watches what a program does at the operating system level while it runs. It uses ptrace, a built in Linux interface for tracing processes, to attach to a target program and record which system calls it makes, the low level requests a program sends to the operating system to do things like open files or allocate memory. The tool currently tracks process related calls such as fork, execve, and wait, which cover when a program starts, launches another program, or waits for one to finish. It also tracks file related calls like open, openat, read, and close, so you can see which files a program touches and how it reads from them. On the memory side, it watches mmap, mprotect, and munmap, the calls a program uses to reserve, change, or release chunks of memory. Network monitoring is listed as a planned feature that has not been built yet. After tracing finishes, the tool generates an HTML report styled with CSS that summarizes everything it observed, organized by process, file, memory, and network activity. To use it, you point the program at a target executable inside the main.c file, build the project with make, and run the resulting binary. The report is saved as report.html and can be opened in any web browser. The project is aimed at people learning how Linux processes and system calls work, or anyone doing lightweight research into what a specific program does under the hood. The author notes it is meant for educational and research use, and that it should only be pointed at programs you own or have permission to inspect. It requires a Linux system with GCC and Make installed, and is released under the MIT License.