Sysdig Documentation

Sysdig is a universal system visibility tool with native support for containers. It instruments the Linux kernel to capture system calls and OS events, providing deep inspection into containers without requiring container instrumentation. It functions as a unified interface for various system tools (similar to a combination of strace, tcpdump, htop, iftop, and lsof).

Csysdig is a simple, intuitive, and fully customizable curses-based UI for the sysdig command-line tool.

csysdig views are implemented as Lua scripts called 'chisels'. You can create your own visualizations or modify existing ones.

View Locations:

• Global views: /usr/share/sysdig/chisels
• Personal views: ~/.chisels

Views rely on the sysdig processing engine and can include any sysdig filter field. For detailed implementation details, refer to the csysdig View Format Reference.

You can connect csysdig to a Kubernetes API server using the -k or --k8s-api flag. You can also provide authentication via the -K or --k8s-api-cert flag.

• API URL: Pass the URL as an argument (e.g., http://admin:password@127.0.0.1:8080) or set the SYSDIG_K8S_API environment variable.
• Authentication: Use -K or --k8s-api-cert with the format certfile:keyfile[#password][:cacertfile]. These must be absolute or relative paths to PEM files. Alternatively, use the SYSDIG_K8S_API_CERT environment variable.

Note: File names containing : or # are not supported for this option.

When contributing to the userspace part of Sysdig, follow these specific coding conventions. Note that these do not apply to kernel code; kernel code must follow the official Linux kernel coding style and pass checkpatch.pl.

Key rules include:

• Braces: Every curly brace ({ and }) must go on its own line.
• Control Flow: Every if and for statement must use curly braces.
• Whitespace: No space between function names and (, or between control statements (like for) and (. Use a space after , and ;.
• Naming: Use camel-case "Unix" style (all lowercase with underscores).
• Types: Use standard C99 types (e.g., int32_t) instead of native C types like int or long for portability.

Use csysdig to monitor live system data with updates every 2 seconds. To analyze an existing sysdig trace file instead of live data, use the -r flag.

# Live system monitoring
csysdig

# Analyze a trace file
csysdig -r /path/to/trace_file

You can run Sysdig using Docker by executing a privileged container that mounts necessary host directories. This allows you to run the sysdig or csysdig tools from within the container shell to inspect the host system.

sudo docker run --rm -i -t --privileged --net=host \
    -v /var/run/docker.sock:/host/var/run/docker.sock \
    -v /dev:/host/dev \
    -v /proc:/host/proc:ro \
    -v /boot:/host/boot:ro \
    -v /src:/src \
    -v /lib/modules:/host/lib/modules:ro \
    -v /usr:/host/usr:ro \
    -v /etc:/host/etc:ro \
    docker.io/sysdig/sysdig

You can capture live system events and save them to a .scap trace file using the -w flag. You can also limit the amount of data captured per buffer using -s (snaplen) and apply filters to save only specific events.

To read a previously captured trace file, use the -r flag.

csysdig uses an interactive ncurses interface. You can explore system behavior through 'drilling down':

• Drill Down: Highlight an entry (like a process or container) and press Enter. The next view will be filtered to show only data related to that specific entity.
• Navigate Back: Press Backspace to return to the previous view.
• Switch Views: Press F2 to open the view picker and select a different visualization.
• Observe I/O: Press F5 to view input/output for the currently selected entity.
• View Events: Press F6 to view sysdig events for the currently selected entity.

To build the Sysdig Docker image, execute the docker build command from the Sysdig root directory, specifying the Dockerfile located at docker/sysdig/Dockerfile.

docker build -f docker/sysdig/Dockerfile .