sysdig grew out of the Wireshark team's realization that most Linux troubleshooting problems could be solved by treating the whole kernel the way tcpdump treats a NIC: capture every syscall, network event, filesystem access, and process change into a single file, then filter it with a query language. Draios open-sourced the lot in 2014. Falco later spun off the runtime-security side, but the analysis tool is still sitting in every distro's repos, quietly ignored.

The pitch is simple. Instead of learning strace, lsof, tcpdump, iotop, ss, and pstree — and running them all at once when something goes sideways in production — you run one command:

sudo sysdig -w /tmp/incident.scap

That file now contains, for the duration of the capture, every syscall on the system with full argument decoding, every FD table change, every process fork/exec/exit, plus the associated cgroup and container context. Ship it home. Replay it locally. Ask questions.

The query language is the point

# Which files got written under /etc during the capture?
sysdig -r /tmp/incident.scap 'evt.type=write and fd.name contains /etc/'

# Every command executed on the system, with timestamps
sysdig -r /tmp/incident.scap -p '%evt.time %proc.name %proc.cmdline' evt.type=execve

# Who's spraying stat() calls at /var/lib?
sysdig -c topprocs_file 'evt.type=stat and fd.name startswith /var/lib'

# Show me every connect() from anything inside container web-1
sysdig -r /tmp/incident.scap 'container.name=web-1 and evt.type=connect'

The filter grammar is Wireshark-family: fields (fd.name, proc.pid, evt.dir, container.image), operators (contains, startswith, in, =, !=), boolean combinators. sysdig -l prints every field — there are hundreds, and they compose.

Chisels: Lua scripts that ship with the binary

sysdig -cl lists the built-in analyses. They read like the questions you actually ask at 2am:

sysdig -c topprocs_cpu                     # like top, but from a capture
sysdig -c topfiles_bytes                   # biggest file I/O consumers
sysdig -c fdcount_by proc.name             # who's leaking FDs
sysdig -c echo_fds proc.name=redis-server  # print every read/write payload
sysdig -c spectrogram                      # syscall latency heatmap in your terminal
sysdig -c stderr proc.name=nginx           # tail stderr of every nginx, live

echo_fds alone is worth the install. It reconstructs actual payloads from read/write syscalls — you can watch a Redis process's protocol traffic without attaching a debugger or restarting anything.

Why not just bpftrace or strace?

strace is per-process and only sees syscalls. bpftrace is fast and low-overhead but it aggregates at capture time — you decide what to measure before the event happens. sysdig captures full event payloads with all context to a file, then lets you decide what questions to ask afterward. That's the whole game for post-incident analysis: you don't know what to look for until you look.

The trade-off is overhead. Capturing everything on a busy box costs a few percent CPU and produces multi-GB files fast, so use -s to cap payload snap-length and event filters (sudo sysdig -w foo.scap proc.name=nginx) to narrow at capture time when you can.

The interactive one

sudo csysdig

An ncurses UI with views (F2) for processes, containers, files, network connections, threads — hit enter on any row to drill into its events. It's htop plus a debugger plus a packet sniffer, and it replays capture files too (csysdig -r foo.scap).