# guillaumelaurin/sysmon architecture

> Architecture diagram of the GitHub repository guillaumelaurin/sysmon, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/guillaumelaurin/sysmon
- Repository: https://github.com/guillaumelaurin/sysmon

## Overview

SysMon is a Windows kernel system-monitoring driver paired with a desktop client. Kernel notification callbacks capture process, thread, image-load, and registry events; the driver queues them for the client to poll. The client decodes and persists events in SQLite, then its GUI pages query and display them. Settings persist separately, while typed exceptions feed a structured error-reporting pipeline. The graph follows the README and sampled application wiring; some kernel queue and event-decoding details are documented but their implementations were not sampled.

Main entry points: [`client/src/app/Application.cpp`](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/app/Application.cpp) (Application), [`client/src/gui/UIRenderer.cpp`](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/UIRenderer.cpp) (UI renderer), [`client/src/storage/EventRepository.cpp`](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/storage/EventRepository.cpp) (Event repository), [`client/src/core/EventProcessor.cpp`](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/core/EventProcessor.cpp) (Event processor)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_kernel["Kernel Capture"]
  node_driver_lifecycle["Driver lifecycle<br/>[Driver.cpp]"]
  node_event_callbacks["Event callbacks<br/>[Device.cpp]"]
  node_kernel_queue["Kernel event queue<br/>[Globals.cpp]"]
  node_device_io["Device I/O<br/>[Queue.cpp]"]
end

subgraph group_client_core["Client Ingest"]
  node_application["Application<br/>[Application.cpp]"]
  node_driver_service["Driver service control<br/>[DriverService.cpp]"]
  node_driver_connector["Driver connector"]
  node_event_processor["Event processor<br/>[EventProcessor.cpp]"]
end

subgraph group_storage["Persistence"]
  node_database[("SQLite database<br/>[Database.cpp]")]
  node_event_repository["Event repository"]
  node_config_repository["Config repository"]
end

subgraph group_gui["Desktop UI"]
  node_gui_pages["Monitoring pages"]
  node_page_manager["Page manager<br/>[PageManager.cpp]"]
  node_router["Router<br/>[Router.cpp]"]
  node_sidebar["Sidebar<br/>[Sidebar.cpp]"]
  node_window["Window<br/>[Win32Window.cpp]"]
  node_ui_renderer["UI renderer<br/>[UIRenderer.cpp]"]
  node_dx_renderer["DirectX renderer<br/>[DX11Renderer.cpp]"]
end

subgraph group_diagnostics["Diagnostics"]
  node_exception_handler["Exception handler"]
  node_error_dispatcher["Error dispatcher"]
  node_error_pipeline["Error pipeline"]
  node_logger["Structured logger<br/>[Logger.cpp]"]
end

node_user(("Desktop user"))
node_driver_device["SysMon device"]

node_driver_lifecycle -->|"registers callbacks"| node_event_callbacks
node_event_callbacks -->|"enqueue events"| node_kernel_queue
node_device_io -->|"reads queued events"| node_kernel_queue
node_driver_connector -->|"opens device"| node_driver_device
node_driver_device -->|"dispatches I/O"| node_device_io
node_application -->|"starts and stops"| node_driver_service
node_application -->|"connects and disconnects"| node_driver_connector
node_application -->|"starts and stops"| node_event_processor
node_event_processor -->|"polls events"| node_driver_connector
node_event_processor -->|"persists decoded events"| node_event_repository
node_application -->|"opens database"| node_database
node_application -->|"wires repository"| node_event_repository
node_application -->|"wires preferences"| node_config_repository
node_event_repository -->|"reads and writes events"| node_database
node_config_repository -->|"reads and writes settings"| node_database
node_gui_pages -->|"queries events"| node_event_repository
node_gui_pages -->|"loads preferences"| node_config_repository
node_application -->|"registers pages"| node_page_manager
node_sidebar -->|"requests navigation"| node_router
node_router -->|"activates pages"| node_page_manager
node_application -->|"initializes and renders"| node_ui_renderer
node_ui_renderer -->|"uses window"| node_window
node_ui_renderer -->|"renders frames"| node_dx_renderer
node_ui_renderer -->|"renders routed page"| node_router
node_user -->|"chooses page"| node_sidebar
node_application -->|"handles exceptions"| node_exception_handler
node_exception_handler -->|"dispatches records"| node_error_dispatcher
node_exception_handler -->|"generates fatal dumps"| node_error_pipeline
node_error_dispatcher -->|"filters and emits"| node_error_pipeline
node_application -->|"wires logger"| node_logger
node_driver_service -->|"logs service status"| node_logger

click node_driver_lifecycle "https://github.com/guillaumelaurin/sysmon/blob/main/src/Driver.cpp"
click node_event_callbacks "https://github.com/guillaumelaurin/sysmon/blob/main/src/Device.cpp"
click node_kernel_queue "https://github.com/guillaumelaurin/sysmon/blob/main/src/Globals.cpp"
click node_device_io "https://github.com/guillaumelaurin/sysmon/blob/main/src/Queue.cpp"
click node_application "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/app/Application.cpp"
click node_driver_service "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/core/DriverService.cpp"
click node_driver_connector "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/core/DriverConnector.cpp"
click node_event_processor "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/core/EventProcessor.cpp"
click node_database "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/storage/Database.cpp"
click node_event_repository "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/storage/EventRepository.cpp"
click node_config_repository "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/storage/ConfigRepository.cpp"
click node_gui_pages "https://github.com/guillaumelaurin/sysmon/tree/main/client/src/gui/pages"
click node_page_manager "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/PageManager.cpp"
click node_router "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/Router.cpp"
click node_sidebar "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/components/Sidebar.cpp"
click node_window "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/Win32Window.cpp"
click node_ui_renderer "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/UIRenderer.cpp"
click node_dx_renderer "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/DX11Renderer.cpp"
click node_exception_handler "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/exceptions/ExceptionHandler.cpp"
click node_error_dispatcher "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/reporter/ErrorDispatcher.cpp"
click node_error_pipeline "https://github.com/guillaumelaurin/sysmon/tree/main/client/src/reporter"
click node_logger "https://github.com/guillaumelaurin/sysmon/blob/main/client/src/logging/Logger.cpp"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_driver_lifecycle,node_event_callbacks,node_kernel_queue,node_device_io,node_user toneBlue
class node_application,node_driver_service,node_driver_connector,node_event_processor toneAmber
class node_database,node_event_repository,node_config_repository toneMint
class node_gui_pages,node_page_manager,node_router,node_sidebar,node_window,node_ui_renderer,node_dx_renderer toneRose
class node_exception_handler,node_error_dispatcher,node_error_pipeline,node_logger,node_driver_device toneIndigo
```

## Components

### Kernel Capture

- [Driver lifecycle](https://github.com/guillaumelaurin/sysmon/blob/main/src/Driver.cpp): `src/Driver.cpp`
- [Event callbacks](https://github.com/guillaumelaurin/sysmon/blob/main/src/Device.cpp): `src/Device.cpp`
- [Kernel event queue](https://github.com/guillaumelaurin/sysmon/blob/main/src/Globals.cpp): `src/Globals.cpp`
- [Device I/O](https://github.com/guillaumelaurin/sysmon/blob/main/src/Queue.cpp): `src/Queue.cpp`

### Client Ingest

- [Application](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/app/Application.cpp): `client/src/app/Application.cpp`
- [Driver service control](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/core/DriverService.cpp): `client/src/core/DriverService.cpp`
- [Driver connector](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/core/DriverConnector.cpp): `client/src/core/DriverConnector.cpp`
- [Event processor](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/core/EventProcessor.cpp): `client/src/core/EventProcessor.cpp`

### Persistence

- [SQLite database](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/storage/Database.cpp): `client/src/storage/Database.cpp`
- [Event repository](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/storage/EventRepository.cpp): `client/src/storage/EventRepository.cpp`
- [Config repository](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/storage/ConfigRepository.cpp): `client/src/storage/ConfigRepository.cpp`

### Desktop UI

- [Monitoring pages](https://github.com/guillaumelaurin/sysmon/tree/main/client/src/gui/pages): `client/src/gui/pages`
- [Page manager](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/PageManager.cpp): `client/src/gui/PageManager.cpp`
- [Router](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/Router.cpp): `client/src/gui/Router.cpp`
- [Sidebar](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/components/Sidebar.cpp): `client/src/gui/components/Sidebar.cpp`
- [Window](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/Win32Window.cpp): `client/src/gui/Win32Window.cpp`
- [UI renderer](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/UIRenderer.cpp): `client/src/gui/UIRenderer.cpp`
- [DirectX renderer](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/gui/DX11Renderer.cpp): `client/src/gui/DX11Renderer.cpp`

### Diagnostics

- [Exception handler](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/exceptions/ExceptionHandler.cpp): `client/src/exceptions/ExceptionHandler.cpp`
- [Error dispatcher](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/reporter/ErrorDispatcher.cpp): `client/src/reporter/ErrorDispatcher.cpp`
- [Error pipeline](https://github.com/guillaumelaurin/sysmon/tree/main/client/src/reporter): `client/src/reporter`
- [Structured logger](https://github.com/guillaumelaurin/sysmon/blob/main/client/src/logging/Logger.cpp): `client/src/logging/Logger.cpp`

### Other components

- **Desktop user**
- **SysMon device**

## Connections

- Driver lifecycle → Event callbacks: registers callbacks
- Event callbacks → Kernel event queue: enqueue events
- Device I/O → Kernel event queue: reads queued events
- Driver connector → SysMon device: opens device
- SysMon device → Device I/O: dispatches I/O
- Application → Driver service control: starts and stops
- Application → Driver connector: connects and disconnects
- Application → Event processor: starts and stops
- Event processor → Driver connector: polls events
- Event processor → Event repository: persists decoded events
- Application → SQLite database: opens database
- Application → Event repository: wires repository
- Application → Config repository: wires preferences
- Event repository → SQLite database: reads and writes events
- Config repository → SQLite database: reads and writes settings
- Monitoring pages → Event repository: queries events
- Monitoring pages → Config repository: loads preferences
- Application → Page manager: registers pages
- Sidebar → Router: requests navigation
- Router → Page manager: activates pages
- Application → UI renderer: initializes and renders
- UI renderer → Window: uses window
- UI renderer → DirectX renderer: renders frames
- UI renderer → Router: renders routed page
- Desktop user → Sidebar: chooses page
- Application → Exception handler: handles exceptions
- Exception handler → Error dispatcher: dispatches records
- Exception handler → Error pipeline: generates fatal dumps
- Error dispatcher → Error pipeline: filters and emits
- Application → Structured logger: wires logger
- Driver service control → Structured logger: logs service status