Why kmon Focuses on the Linux Kernel and Kernel Modules

kmon is a Linux kernel manager and activity monitor, so its scope is the kernel itself: the part of the operating system that mediates between hardware and software. It focuses there because the kernel owns the low-level work — memory management, process management, device management, system calls, and security — and because that work happens in a separate, protected region of memory that ordinary applications cannot inspect or change. A tool that shows kernel activity and lets you manage kernel modules has to target that layer directly; user-space tools cannot substitute for it.

What the kernel does, and why it is separated from applications

On most systems the kernel is loaded at startup after the bootloader. It handles I/O requests and peripherals such as keyboards, monitors, network adapters, and speakers. Applications request services through the system-call mechanism, usually via a library provided by the operating system that invokes the corresponding kernel function.

The kernel resides in protected kernel space, which applications and other parts of the system cannot access. Browsers, text editors, window managers, and audio/video players run in user space. This separation keeps user data and kernel data from interfering with each other — preventing instability and slowness — and stops a malfunctioning application from crashing the whole operating system. That boundary is exactly why observing kernel behavior requires a dedicated tool rather than an ordinary user-space program.

Why the Linux kernel's design matters for a monitor

Kernel designs differ in how they manage system calls and resources. Monolithic kernels run all operating-system instructions in the same address space for speed; microkernels use different spaces for user and kernel services for modularity; hybrid kernels, nanokernels, and exokernels combine or refine these approaches.

The Linux kernel is open-source, monolithic, and Unix-like. It is used in Linux distributions, embedded systems such as routers, and all Android-based systems. Linus Torvalds created it in 1991, and it is still developed by thousands of developers. Because Linux is monolithic, kernel functionality — including loadable kernel modules — lives in that single kernel address space, which is why a manager for kernel modules and kernel activity is a coherent, focused tool rather than a broad system utility.

What this means in practice for kmon users

The site's framing of kmon follows from the above: the kernel is the layer that handles I/O, peripherals, memory, processes, devices, system calls, and security, and kmon is positioned as the manager and activity monitor for that layer. Concretely, this focus implies:

• Module management is kernel-level work. Kernel modules extend kernel functionality, so loading, unloading, or inspecting them is an operation on the kernel, not on user-space applications.
• Activity monitoring means kernel activity. What kmon surfaces is the kernel's own state and behavior, which is otherwise hidden behind the user/kernel space boundary.
• The tool is Linux-specific. Its subject — the Linux kernel — is the open-source, monolithic, Unix-like kernel used across distributions, embedded systems, and Android.

For installation, usage, key bindings, features, and the roadmap, see the site's own sections: Installation, Usage, Key Bindings, Features, and Roadmap. The project is hosted on GitHub at orhun/kmon, with ZIP and TAR downloads and a "View On GitHub" link; the site also links to OpenCollective backer and sponsor checkout pages for those who want to support it.