Disclaimer
Opinions expressed are solely my own and do not express the views
or opinions of my employer.
Feel free to ask questions during the presentation.
About Me
Red Hat Consultant
Specialize in Kubernetes, Docker,
and OpenShift
10+ years Linux administration
Using sysdig for 3 years
Previously used nagios and zabbix
What is sysdig?
“Sysdig is open source, system-level exploration: capture
system state and activity from a running Linux instance, then
save, filter and analyze.”
strace + tcpdump + htop + iftop + lsof +
transaction tracing + awesome sauce.
Creators of WinPCap and Wireshark, system level troubleshooting
made easy.
Captures system calls and system level events via tracepoints.
Less overhead than strace.
Container aware.
sysdig
# list all events
$ sysdig
# list chisels
$ sysdig -cl
# top process by CPU usage
$ sudo sysdig -c topprocs_cpu
# top process by network I/O in container "nginx"
$ sudo sysdig -pc -c topprocs_net container.name=nginx
# Save the first 100 events
$ sudo sysdig -n 100 -z -w dump.scap.gz
Sysdig User Guide
Sysdig Examples
Option to limit the size of capture files
Option to rotate capture files
csysdig
Demo
sysdig -cl
csysdig
docker run --rm -ti -p 8080:80 --name nginx nginx:latest
sudo csysdig
while :; do curl -s localhost:8080 >/dev/null; sleep 1; done
sysdig cloud
Tracking Server Issues
Capture system state before reboot
Inspect container resources
Traverse CPU to process to network
Apache memory usage
Security Monitoring
Sysdig Falco
Fishing for Hackers
sysdig falco: behavioral activity monitor designed to detect
anomalous activity in your applications, containers, hosts,
network activity, etc.
snort + ossec + strace.
Honeypot: `sysdig -c spy_user`