Note: this content is mirrored from the sysdig github repository. Please go there to edit or contribute to the sysdig wiki.
We built sysdig to give you easy access to the actual behavior of your Linux systems and containers. Honestly, the best way to understand sysdig is to try it - its super easy! Or here's a quick video introduction to csysdig, the curses-based UI for sysdig: https://www.youtube.com/watch?v=UJ4wVrbP-Q8
Far too often, system-level monitoring and troubleshooting still involves logging into a machine with SSH and using a plethora of dated tools with very inconsistent interfaces. And many of these classic Linux tools breakdown completely in containerized environments. Sysdig unites your Linux toolkit into a single, consistent, easy-to-use interface. And sysdig's unique architecture allows deep inspection into containers, right out of the box, without having to instrument the containers themselves in any way.
Sysdig provides additional value by focusing on a few key principles:
Think about sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce.
Sysdig instruments your physical and virtual machines at the OS level by installing into the Linux kernel and capturing system calls and other OS events. Then, using sysdig's command line interface or curses-based UI, csysdig, you can filter and decode these events in order to extract useful information. Sysdig can be used to inspect systems live in real-time, or to generate trace files that can be analyzed at a later stage.
Please explore this wiki where you will find a variety of documents that will walk you through the full functionality of sysdig. For example, here are some examples of cool things you can do with sysdig, and here's a user guide that will introduce you to using the tool.