This document discusses several Linux system monitoring and troubleshooting tools, including strace, Wireshark, eBPF, and Sysdig. It provides examples of commands to capture system calls and file operations with Sysdig, filter captures, and view process information. Additional resources about Sysdig features like chisels and event filtering are also listed.

1. Alejandro E. Brito Monedero
@ae_bm
http://us.cdn1.123rf.com/168nwm/chagall/chagall0903/chagall090300002/4464959-a-pot-of-gold.jpg

2. http://vancouvertoollibrary.com/wp-content/uploads/2016/02/tools_cropped.jpg

3. http://www.tac-focus.com/sites/default/files/images/HowDoYouSeeTheWorld.jpg

4. https://www.sciencenews.org/sites/default/files/2016/01/main/articles/012216_ag_entangledhistory_free.jpg

5. strace
It cannot trace all processes
UX ….
Context switches everywhere
multiprocess ….

6. Wireshark
Only network
High traffic networks
How to relate a network capture with a process
that is not currently running?

7. http://www.ababolfashion.com/sites/default/files/imagecache/product_full/i_small_crop.jpg

8. eBPF
http://cdn.static-economist.com/sites/default/files/images/print-edition/20130406_LDP001_0.jpg

9. HN
http://www.fatosdesconhecidos.com.br/wp-content/uploads/2015/05/1105.jpg

10. Sysdig
strace & wireshark had a child
containers containers containers
save captures
chisels (lua scripts)
syscall level only
Needs to compile a kernel module

11. http://www.brendangregg.com/Perf/linux_observability_tools.png
Sysdig

12. Containers
docker run -i -t --name sysdig --privileged -v
/var/run/docker.sock:/host/var/run/docker.sock
-v /dev:/host/dev -v /proc:/host/proc:ro
-v /boot:/host/boot:ro
-v /lib/modules:/host/lib/modules:ro
-v /usr:/host/usr:ro sysdig/sysdig
http://www.sysdig.org/install/

13. Examples
Store all the open syscalls in the system
sysdig -w capture.scap evt.type=open
Top 10 slowest syscalls
sysdig -c bottlenecks "evt.latency > 0"

14. Examples
What does cron writes or read from its FDs
sysdig -c echo_fds disable_color proc.name=cron
What files where opened in the system
sysdig -r capture.scap -p "%proc.name" | sort | uniq

15. Examples
Create a more filtered captured file
sysdig -r capture.scap -w comm_capt.scap
“proc.name = command”
P0rn
sysdig -c spectrogram
sysdig -c subsecoffset
csysdig

16. More info about sysdig
Internet
http://www.sysdig.org/wiki/
https://sysdig.com/blog/linux-
troubleshooting-cheatsheet/
View all filters available
sysdig -l

17. More info about sysdig
List chisels
sysdig -cl
View supported events
sysdig -L
Chisel info
sysdig -i <chisel>

18. Happy ending
http://adorablekittens.com/wp-content/uploads/2015/10/cats.jpg