csysdig

Sysdig is a Linux system exploration and troubleshooting tool. It installs into the Linux kernel and captures system calls and other OS events on physical and virtual machines. The README describes it as combining the functions of strace, tcpdump, htop, iftop and lsof in one interface. The sysdig command is the CLI front end, and csysdig is a curses-based UI on top of it that the README describes as fully customizable.

Sysdig has native container support. It can inspect containers without instrumenting them. This addresses the README's point that many classic Linux tools break down in containerized environments. It can also write trace files of system activity, similar to what tcpdump and Wireshark do for network traffic. The trace files store system state alongside the captured events, so the activity can be analyzed later in context.

Sysdig is aimed at developers, SREs and operators who troubleshoot hosts and containers and would otherwise SSH in and use several separate tools. It can run from a Docker container with the host's /proc, /dev, /boot and other paths mounted, or be installed from the deb and rpm packages on the releases page. Full documentation is in the project wiki.

Installation

# via Docker
sudo docker run --rm -i -t --privileged --net=host \
    -v /var/run/docker.sock:/host/var/run/docker.sock \
    -v /dev:/host/dev \
    -v /proc:/host/proc:ro \
    -v /boot:/host/boot:ro \
    -v /src:/src \
    -v /lib/modules:/host/lib/modules:ro \
    -v /usr:/host/usr:ro \
    -v /etc:/host/etc:ro \
    docker.io/sysdig/sysdig