Recently in the study of network security, the study found that there are often some behavior is instant, it is hard to capture only the process ID of the log, the current view is not in the, are there any tools or methods can view the historical progress, and the great spirit guide