Training courses
Kernel and Embedded Linux
Bootlin training courses
1 2 3
Proc - Process based analysis This would include activity by PID, and syscall analysis.