PAGES
← all tools
◆ Post-Exploitation

pspy

v1.1.0 open-source

Monitors and logs Linux processes without root privileges by scanning procfs and using inotify file system watchers.

source ↗ rss ↗ What is a cyber toolchain?

Summary

pspy is an open-source command-line tool that lets you watch processes running on a Linux system without needing root permissions, catching commands, cron jobs and short-lived processes as they execute by scanning procfs and watching the file system with inotify. It ships as static binaries you run directly on the target machine, no installation or elevated privileges required, which makes it a fixture in CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. enumeration and privilege-escalation work and useful for demonstrating why secrets passed as command-line arguments leak to other users. It sits in the post-exploitation enumeration space alongside other Linux recon utilities rather than replacing any single named tool. Development is old but thin: first committed in 2018 with 8 contributors and four tracked releases, though only one commit landed in the past year.

Monitors and logs Linux processes without root privileges by scanning procfs and using inotify file system watchers.

How pspy helps

Which processes are other users or root running on this box right now, including ones that finish before I could list them?

scans procfs on a timer and backfills between scans with inotify watchers on the file system, so a process that starts and exits in under a second still gets caught and logged

What is that cron job actually running, and with what arguments?

catches the short-lived child process at execution time and prints its full command line as it fires, rather than relying on the crontab file, which may not show what a wrapper script does

Which directories on this system have activity worth watching before I commit to full-time scanning?

can watch a chosen set of directories recursively or non-recursively for file system events alone, letting you scope out where processes are touching files before turning command logging back on

How often should I sample this system to catch what I am looking for without flooding the output?

lets you set the interval between procfs scans and whether commands are printed at all, trading detection speed against log volume

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities · 2 backed by code, an API document or a real run

Built from pspy's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What pspy offers you

  • Command-line interface2
All capabilities 4 capabilities
Process recording verified Captures process execution details including command lines, truncation of long commands, and parent process IDs. 1 release · 3 other sources · first seen Aug 2019

Also counts toward: Command-line interface

release

  • Updated color scheme: process events now use distinct colors per UID, while file system events are rendered without color v1.1.0 · Aug 2019 · source · release history

docs

  • Monitors and logs Linux processes without root privileges by scanning procfs and using inotify file system watchers.

command line

Debug output verified Prints detailed error messages to aid in diagnosing issues. 1 release · 3 other sources · first seen Aug 2019

Also counts toward: Command-line interface

release

  • --debug CLI flag introduced to display inotify-related errors that are now hidden by default v1.1.0 · Aug 2019 · source · release history

command line

example

  • Debug inotify buffer errors on systems with very deep or long file paths by enabling verbose output. pspy --debug v1.1.0 · Aug 2019 · source
  • Show all flags and their meaning pspy --help
File system event monitoring shipped Observes and logs file system changes by watching specific directories recursively or non-recursively. 2 other sources

example

  • Watch multiple directories recursively and non-recursively ./pspy64 -r /path/to/first/recursive/dir -r /path/to/second/recursive/dir -d /path/to/the/non-recursive/dir
  • Disable commands, enable file system events only ./pspy64 -p=false -f
Real-time command and event reporting shipped Displays executed commands and file system events at regular intervals. 1 other source

example

  • Print commands and file system events every 1s ./pspy64 -pf -i 1000

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for pspy, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail pspy puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

1 entry

  1. August 20191

    1 entry

    1. v1.1.0 Aug 11, 2019 · release notes

      pspy v1.1.0 adds --debug flag to expose suppressed error messages for large inotify paths

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1.0 https://github.com/DominicBreuker/pspy.git
# already have the repo? check out this version:
$ git checkout v1.1.0
      └──▷ TRY IT
      Debug inotify buffer errors on systems with very deep or long file paths by enabling verbose output.
      $ pspy --debug
      • --debug CLI flag introduced to display inotify-related errors that are now hidden by default
      • Updated color scheme: process events now use distinct colors per UID, while file system events are rendered without color

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in DominicBreuker/pspy, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 +1 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 3 of 13 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 3
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 6,179
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback