Useful sysdig command examples

Sysdig is a robust open-source tool widely used by Linux system administrators, developers, and security professionals to capture and analyze system calls and events in real time. It provides deep visibility into the kernel level, enabling troubleshooting, monitoring, and forensics tasks beyond typical monitoring tools. Key sysdig capabilities revolve around its 'chisels'—predefined scripts that filter and format output to extract meaningful insights, such as identifying top CPU- or memory-consuming processes, active network connections, and file access events. For example, the chisel 'topprocs_cpu' highlights processes with the highest CPU consumption, while 'topconns' shows top network connections by total bytes transferred. Sysdig’s filtering syntax is versatile, allowing queries by event types (e.g., 'evt.type=conn' to track network connections), process names (e.g., 'proc.name=nginx' to capture events involving the NGINX web server), or file operations (e.g., 'evt.type=unlink' to detect file deletions). Combining multiple conditions can filter complex scenarios such as active network connections on specified IP addresses or monitoring specific container processes. Additional features include capturing output to .scap files for offline analysis or splitting and rotating capture files by size or duration, which is critical for sustained system monitoring in production environments. For cybersecurity use cases, sysdig can detect suspicious activity like network scanning by events connecting to certain IPs or processes resembling scanning behavior (e.g., 'proc.name=nmap'). It can also monitor users' interactive shell activities, giving administrators tools for auditing and incident response. Those interested in deepening their sysdig usage or learning Linux system monitoring comprehensively can find extensive infographics and high-resolution PDF books at https://study-notes.org, encompassing sysdig usage and other Linux-related content. Harnessing sysdig effectively requires understanding Linux kernel events, system calls, and network protocols, but its powerful real-time capture and comprehensive filtering make it indispensable for system visibility, performance tuning, and security investigations.