How guillaumelaurin/sysmon works
SysMon is a Windows kernel system-monitoring driver paired with a desktop client. Kernel notification callbacks capture process, thread, image-load, and registry events; the driver queues them for the client to poll. The client decodes and persists events in SQLite, then its GUI pages query and display them. Settings persist separately, while typed exceptions feed a structured error-reporting pipeline. The graph follows the README and sampled application wiring; some kernel queue and event-decoding details are documented but their implementations were not sampled.
Main entry points: Application.cpp Application · UIRenderer.cpp UI renderer · EventRepository.cpp Event repository · EventProcessor.cpp Event processor
Components 24
Kernel Capture
- Driver lifecycle
src/Driver.cpp - Event callbacks
src/Device.cpp - Kernel event queue
src/Globals.cpp - Device I/O
src/Queue.cpp
Client Ingest
- Application
client/src/app/Application.cpp - Driver service control
client/src/core/DriverService.cpp - Driver connector
client/src/core/DriverConnector.cpp - Event processor
client/src/core/EventProcessor.cpp
Persistence
- SQLite database
client/src/storage/Database.cpp - Event repository
client/src/storage/EventRepository.cpp - Config repository
client/src/storage/ConfigRepository.cpp
Desktop UI
- Monitoring pages
client/src/gui/pages - Page manager
client/src/gui/PageManager.cpp - Router
client/src/gui/Router.cpp - Sidebar
client/src/gui/components/Sidebar.cpp - Window
client/src/gui/Win32Window.cpp - UI renderer
client/src/gui/UIRenderer.cpp - DirectX renderer
client/src/gui/DX11Renderer.cpp
Diagnostics
- Exception handler
client/src/exceptions/ExceptionHandler.cpp - Error dispatcher
client/src/reporter/ErrorDispatcher.cpp - Error pipeline
client/src/reporter - Structured logger
client/src/logging/Logger.cpp
Other components
- Desktop user
- SysMon device
Connections 31
- Driver lifecycle → Event callbacks: registers callbacks
- Event callbacks → Kernel event queue: enqueue events
- Device I/O → Kernel event queue: reads queued events
- Driver connector → SysMon device: opens device
- SysMon device → Device I/O: dispatches I/O
- Application → Driver service control: starts and stops
- Application → Driver connector: connects and disconnects
- Application → Event processor: starts and stops
- Event processor → Driver connector: polls events
- Event processor → Event repository: persists decoded events
- Application → SQLite database: opens database
- Application → Event repository: wires repository
- Application → Config repository: wires preferences
- Event repository → SQLite database: reads and writes events
- Config repository → SQLite database: reads and writes settings
- Monitoring pages → Event repository: queries events
- Monitoring pages → Config repository: loads preferences
- Application → Page manager: registers pages
- Sidebar → Router: requests navigation
- Router → Page manager: activates pages
- Application → UI renderer: initializes and renders
- UI renderer → Window: uses window
- UI renderer → DirectX renderer: renders frames
- UI renderer → Router: renders routed page
- Desktop user → Sidebar: chooses page
- Application → Exception handler: handles exceptions
- Exception handler → Error dispatcher: dispatches records
- Exception handler → Error pipeline: generates fatal dumps
- Error dispatcher → Error pipeline: filters and emits
- Application → Structured logger: wires logger
- Driver service control → Structured logger: logs service status