Sysdig was built to give you easy access to the actual behavior of your Linux systems and containers. Far too often, system-level monitoring and troubleshooting still involves logging into a machine with SSH and using a plethora of dated tools with inconsistent interfaces. Many of these classic Linux tools breakdown in containerized environments. Sysdig unites your Linux toolkit into a single, easy-to-use interface and provides deep inspection capabilities into containers without having to instrument the containers themselves in any way.

Sysdig instruments your physical and virtual machines at the OS level by installing into the Linux kernel and capturing system calls and other OS events. Then, using Sysdig's command line interface or curses-based UI, Csysdig, you can filter and decode these events in order to extract useful information. Sysdig can be used to inspect systems in real-time or generate trace files that can be analyzed at a later stage without losing important system information (similar to what you can do for networks with tools like tcpdump and Wireshark).

Please explore this wiki (https://github.com/draios/sysdig/wiki/Sysdig-Overview) where you will find documentation on the full functionality of Sysdig. For example, here is a user guide that will introduce you to using the tool (https://github.com/draios/sysdig/wiki/Sysdig-User-Guide).

Happy digging!