# csysdig

> Linux system visibility tool that captures syscalls and OS events, with container support; csysdig is its curses-based UI.

Stars: 8.3k · Language: C++ · Categories: System

- Repository: https://github.com/draios/sysdig
- Website: http://www.sysdig.com/
- Page: https://www.trmn.sh/tools/sysdig

## Install

- Docker: `sudo docker run --rm -i -t --privileged --net=host \`
- Docker: `-v /var/run/docker.sock:/host/var/run/docker.sock \`
- Docker: `-v /dev:/host/dev \`
- Docker: `-v /proc:/host/proc:ro \`
- Docker: `-v /boot:/host/boot:ro \`
- Docker: `-v /src:/src \`
- Docker: `-v /lib/modules:/host/lib/modules:ro \`
- Docker: `-v /usr:/host/usr:ro \`
- Docker: `-v /etc:/host/etc:ro \`
- Docker: `docker.io/sysdig/sysdig`

## Overview

Sysdig is a Linux system exploration and troubleshooting tool. It installs into the Linux kernel and captures system calls and other OS events on physical and virtual machines. The README describes it as combining the functions of strace, tcpdump, htop, iftop and lsof in one interface. The `sysdig` command is the CLI front end, and `csysdig` is a curses-based UI on top of it that the README describes as fully customizable.

Sysdig has native container support. It can inspect containers without instrumenting them. This addresses the README's point that many classic Linux tools break down in containerized environments. It can also write trace files of system activity, similar to what tcpdump and Wireshark do for network traffic. The trace files store system state alongside the captured events, so the activity can be analyzed later in context.

Sysdig is aimed at developers, SREs and operators who troubleshoot hosts and containers and would otherwise SSH in and use several separate tools. It can run from a Docker container with the host's /proc, /dev, /boot and other paths mounted, or be installed from the deb and rpm packages on the releases page. Full documentation is in the project wiki.

### Installation

```bash
# via Docker
sudo docker run --rm -i -t --privileged --net=host \
    -v /var/run/docker.sock:/host/var/run/docker.sock \
    -v /dev:/host/dev \
    -v /proc:/host/proc:ro \
    -v /boot:/host/boot:ro \
    -v /src:/src \
    -v /lib/modules:/host/lib/modules:ro \
    -v /usr:/host/usr:ro \
    -v /etc:/host/etc:ro \
    docker.io/sysdig/sysdig
```

## Alternatives

- [lnav](https://www.trmn.sh/tools/lnav.md): Terminal log file viewer that merges, formats, and indexes log files with SQL analysis and real-time monitoring (C++, 10.8k stars)
- [ncmpcpp](https://www.trmn.sh/tools/ncmpcpp.md): ncurses-based terminal client for MPD (Music Player Daemon) with tag editor, playlist editor, media library, and visualizer, inspired by ncmpc. (C++, 2.5k stars)
- [btop](https://www.trmn.sh/tools/btop.md): Terminal-based system resource monitor showing CPU, memory, disk, network, and process information (C++, 35.2k stars)
- [zerobrew](https://www.trmn.sh/tools/zerobrew.md): Experimental Homebrew-compatible package client for macOS and Linux that uses content-addressable storage and APFS clonefiles for faster installs. (Rust, 8.2k stars)
- [htop](https://www.trmn.sh/tools/htop.md): Cross-platform interactive process viewer with real-time system monitoring and process management (C, 8.4k stars)

---

Canonical: https://www.trmn.sh/tools/sysdig