How to Install and Use Sysdig from Linux Command Line?

Sysdig is a tool that provides administrators and developers with unparalleled insight into their systems' behavior. The team behind it hopes to enhance system-level monitoring and troubleshooting by providing a centralized, coherent, and granular view of the storage, transmission, network, and memory subsystems, as well as the ability to generate trace files for system operation that can be analyzed at any time. They've also created a filtering language that allows them to dig into data in a natural and interactive way, as well as a large library of Lua scripts called chisels that solve common problems. Consider this program to be a supercharged version of strace, tcpdump, and lsof. In a nutshell, it's a robust performance analysis method for analyzing the state of a system and its activities.

How To Install Sysdig

First, we need to install curl using the below command, if you already have, you can skip this step:

$ sudo apt-get install curl

Now simply run the following command to install sysdig automatically in one stage. After checking all the specifications, the installation script can only install the sysdig package from the Draios APT/YUM repository.

$ curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash

Basic usage

The most simple example is to run it without any arguments to see a live stream of events from your Linux system:

$ sudo sysdig

Filtering

Sysdig's filtering mechanism is robust and adaptable, and it's built to find needles in a haystack. Filters, similar to tcpdump, are defined at the end of the command line and can be applied to both live capture and a capture file. Take, for example, the action of a single command:

$ sudo sysdig proc.name=cat

You may use operators like "or" and "and" to combine several arguments. For example, you can capture the activity of both cat and vi at the same time using the below command:

$ sysdig proc.name=cat or proc.name=vi

Type: to see a list of system processes:

$ sudo sysdig -c ps

Run the following command to see the system's network connections:

$ sudo sysdig -c netstat

Run the following command to see the top processes ranked by CPU utilization percentage:

$ sudo sysdig -c topprocs_cpu

Sysdig combines the functionality of a number of command-line tools into a single impressive GUI, enabling you to delve deep into your Linux device events to collect data, save it for later review, and even support containers.