Sysdig

Sysdig is a Linux system observability tool and kernel event analyzer designed for capturing and analyzing kernel-level system calls and operating system events. It functions as a system call tracer and container security monitor, providing deep visibility into the activity of machines, virtual machines, and containers.

The project specializes in non-invasive container inspection, allowing for the monitoring of container activity and resource usage without modifying the container environment or adding instrumentation. It enables the recording of detailed system traces into binary files for retrospective offline analysis and debugging.

The toolset covers broad capability areas including host environment diagnostics, Linux system troubleshooting, and interactive system state visualization via a terminal user interface. Security is managed through execution group restrictions to limit tool access to authorized privileged users.

Features

Kernel Event Tracers - Intercepts system calls and operating system events directly from the kernel for deep visibility into system activity.
Container Monitoring - Inspects the behavior and resource usage of containers through non-invasive kernel monitoring.
Container Inspection Interfaces - Analyzes container activity by monitoring host kernel interfaces without modifying the container environment.
Activity Recording - Records system calls and OS events at the kernel level for deep visibility into machines and containers.
Container Security - Monitors container activity and system state for security purposes without requiring environment instrumentation.
Container Observability Tools - Analyzes system activity within containers without requiring modification of the container environment.
System Call Tracing - Records detailed system traces and activity files for retrospective offline analysis of Linux system behavior.
Trace Recording - Provides the ability to record detailed system traces into binary files for retrospective offline analysis and debugging.
Linux Troubleshooting - Analyzes kernel-level system calls and OS events to diagnose performance issues or crashes on Linux machines.
Environment Diagnostics - Investigates interactions between the host kernel and virtualized environments to resolve system conflicts.
Execution Tracing Systems - Analyzes stored trace files of system activity to preserve rich context for retrospective debugging.
Terminal Interaction - Displays system activity and resource usage through a customizable interactive terminal user interface.
System Trace Serialization - Records detailed system state and activity into binary files for retrospective offline analysis and troubleshooting.
Terminal User Interfaces - Provides a customizable text-based user interface for real-time visualization of system resource usage and activity.
Endpoint Monitoring Tools - Deep system visibility tool for Linux and containers.
Forensics and Incident Response - System exploration and troubleshooting tool for Linux.
Observability and Monitoring - System exploration and troubleshooting tool for Linux.
Troubleshooting Tools - System-level capture and analysis tool for Linux.
Command Line Tools - Listed in the “Command Line Tools” section of the The Book Of Secret Knowledge awesome list.
System Dashboards - Linux system exploration and troubleshooting with container support.
Troubleshooting Tools - Captures and analyzes system state and activity.

Star 历史

draiossysdig

Name: draios/sysdig
Author: draios

View on GitHub

8,261 星标757 分支C++2 次浏览www.sysdig.com

Sysdig

Features

Kernel Event Tracers - Intercepts system calls and operating system events directly from the kernel for deep visibility into system activity.
Container Monitoring - Inspects the behavior and resource usage of containers through non-invasive kernel monitoring.
Container Inspection Interfaces - Analyzes container activity by monitoring host kernel interfaces without modifying the container environment.
Activity Recording - Records system calls and OS events at the kernel level for deep visibility into machines and containers.
Container Security - Monitors container activity and system state for security purposes without requiring environment instrumentation.
Container Observability Tools - Analyzes system activity within containers without requiring modification of the container environment.
System Call Tracing - Records detailed system traces and activity files for retrospective offline analysis of Linux system behavior.
Trace Recording - Provides the ability to record detailed system traces into binary files for retrospective offline analysis and debugging.
Linux Troubleshooting - Analyzes kernel-level system calls and OS events to diagnose performance issues or crashes on Linux machines.
Environment Diagnostics - Investigates interactions between the host kernel and virtualized environments to resolve system conflicts.
Execution Tracing Systems - Analyzes stored trace files of system activity to preserve rich context for retrospective debugging.
Terminal Interaction - Displays system activity and resource usage through a customizable interactive terminal user interface.
System Trace Serialization - Records detailed system state and activity into binary files for retrospective offline analysis and troubleshooting.
Terminal User Interfaces - Provides a customizable text-based user interface for real-time visualization of system resource usage and activity.
Endpoint Monitoring Tools - Deep system visibility tool for Linux and containers.
Forensics and Incident Response - System exploration and troubleshooting tool for Linux.
Observability and Monitoring - System exploration and troubleshooting tool for Linux.
Troubleshooting Tools - System-level capture and analysis tool for Linux.
Command Line Tools - Listed in the “Command Line Tools” section of the The Book Of Secret Knowledge awesome list.
System Dashboards - Linux system exploration and troubleshooting with container support.
Troubleshooting Tools - Captures and analyzes system state and activity.

Sysdig 的开源替代方案

相似的开源项目，按与 Sysdig 的功能重合度排序。

falcosecurity/falco
falcosecurity/falco
8,670在 GitHub 上查看
Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments
C++cloud-nativecncfcncf-project
在 GitHub 上查看8,670
brendangregg/perf-tools
brendangregg/perf-tools
10,434在 GitHub 上查看
This project is a specialized toolset for profiling kernel latency, analyzing tracepoint frequency, and monitoring system-wide performance data. It functions as a kernel performance profiler, tracepoint analyzer, and a collection of utilities for the Linux ftrace and perf_events subsystems. The toolkit provides high-level abstractions via shell-scripted wrappers to manage complex kernel tracing interfaces. It distinguishes itself through the use of bucket-based event histograms to visualize the distribution of kernel events and the ability to identify functions exceeding specific latency thre
Shell
在 GitHub 上查看10,434
google/cadvisor
google/cadvisor
19,202在 GitHub 上查看
cAdvisor is a container resource monitoring agent and performance analyzer that collects and exports CPU, memory, network, and disk usage statistics from running containers. It functions as a telemetry tool for discovering containers across various runtimes and serves as a Prometheus-compatible metrics exporter. The agent distinguishes itself by analyzing Linux control groups to provide visibility into resource consumption and limits. It utilizes kernel perf events and NUMA statistics for low-level hardware performance tracking and diagnostics, and it can identify out-of-memory kill events th
Go
在 GitHub 上查看19,202
cilium/tetragon
cilium/tetragon
4,753在 GitHub 上查看
Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration
C
在 GitHub 上查看4,753

查看 Sysdig 的所有 30 个替代方案

常见问题解答

draios/sysdig 是做什么的？

draios/sysdig 的主要功能有哪些？

draios/sysdig 的主要功能包括：Kernel Event Tracers, Container Monitoring, Container Inspection Interfaces, Activity Recording, Container Security, Container Observability Tools, System Call Tracing, Trace Recording。

draios/sysdig 有哪些开源替代品？

draios/sysdig 的开源替代品包括： falcosecurity/falco — Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and… brendangregg/perf-tools — This project is a specialized toolset for profiling kernel latency, analyzing tracepoint frequency, and monitoring… google/cadvisor — cAdvisor is a container resource monitoring agent and performance analyzer that collects and exports CPU, memory,… cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.… inspektor-gadget/inspektor-gadget — Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and… nicolargo/glances — Glances is a cross-platform system monitoring tool designed to track real-time resource usage and hardware health…