TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Show HN: Sysdig, a tool for Linux system exploration

171 pointsby degioabout 11 years ago

16 comments

brendangreggabout 11 years ago
Impressive. Easy to get going, low overhead, powerful one-liners.<p>I like the filter syntax - would be nice for perf_events to pick this up. Although, if it did, I hope that the stable filter fields API can be extended with unstable arbitrary expressions as needed, for when dynamic probes are used.<p>What perf_events realy lacks is a way for custom processing of data in kernel context, to reduce the overheads of enablings. Eg, lets say I want a histogram of disk I&#x2F;O latency. sysdig has chisels, which look like they do what I want, but from the Chisels User Guide: &quot;Usually, with dtrace-like tools you write your scripts using a domain-specific language that gets compiled into bytecode and injected in the kernel. Draios uses a different approach: events are efficiently brought to user-level, enriched with context, and then scripts can be applied to them.&quot; Oh no, not user-level!<p>I tested this quickly, expecting DTrace&#x27;s approach (which is the same as SystemTap and ktap) to blow sysdig out of the water. But the results were surprising (take these quick tests with a grain of salt). Here&#x27;s my target command, along with sysdig and DTrace enablings, and strace for comparison:<p><pre><code> Target: dd if=&#x2F;dev&#x2F;zero of=&#x2F;dev&#x2F;null bs=1k count=1000k sysdig: sysdig -c topfiles_bytes DTrace: dtrace -n &#x27;syscall:::entry &#x2F;execname == &quot;dd&quot;&#x2F; { @[probefunc] = count(); }&#x27; strace: strace -c dd ... </code></pre> sysdig slowed the target by about 4x. DTrace, between 2.5 and 2.7x. strace (for comparison), over 200x. This is a worst-case test, and if I&#x27;m willing to slow a target by 2x then taking that to 4x doesn&#x27;t make much difference. With what I normally trace, the overheads are 1&#x2F;100th of that, so DTrace is negligible. The take-away here is that the overheads are closer to the &quot;negligible&quot; end of the spectrum than strace&#x27;s &quot;violent&quot; end. Which I found surprising for user-level aggregation.<p>The Sysdig Examples could do with some sanity checking. Eg:<p>&quot;See the top processes in terms of disk bandwidth usage sysdig -c topprocs_file&quot;<p>I saw:<p><pre><code> Bytes Process ------------------------------ 134.65M dd 4.82KB snmp-pass 603B snmpd 332B sshd 220B bash 107B sysdig </code></pre> That&#x27;s while my dd between &#x2F;dev&#x2F;zero and &#x2F;dev&#x2F;null was running. No &quot;disk bandwidth&quot;! :)<p>edit: formatting
评论 #7526275 未加载
评论 #7532930 未加载
otterleyabout 11 years ago
I had the privilege of early access to sysdig thanks to the developers. It&#x27;s not as powerful as SystemTap or DTrace but it is very useful and easy to use. Think of it as strace(8) with global dump capability (not just per-process), more powerful filters, replayable logging à la tcpdump(8), and Lua plugin support.<p>Plus the packaging is top-notch; its kernel modules are rebuilt automatically on kernel upgrade via DKMS (which I wish other vendors like FusionIO would do).
peterwwillisabout 11 years ago
I like that you link to the github, where the README is a link to your more-slick website, which has nothing but a couple of examples and an install page, all of which is really linkbait for your company Draios. It almost seemed like you were just sharing a useful tool. The tool might be really useful, but at this point i&#x27;m still clicking through links trying to figure out what it does and how.<p>edit: Nevermind, I found it. It&#x27;s a kernel module and user app that uses Lua scripts for interpreting data. Sorry about my harsh tone before, but jesus I hate it when there&#x27;s more gloss than content.
评论 #7524792 未加载
zokierabout 11 years ago
I feel like some introductory article about the different instrumentation facilities available for Linux systems would be welcome. Just checking wikipedia and google, I found the following items: SystemTap, Dprobes, LTTng, DTrace, strace, ltrace (and latrace), ktap, utrace, ftrace, kprobes, jprobes. And now we have sysdig too.
评论 #7531947 未加载
shubbabout 11 years ago
Looks very useful. Some things you can do with it:<p>Dump system activity to file, so that sysdig can be used to process it later.<p>* sysdig -w trace.scap<p>Print process name and connection details for each incoming connection not served by apache.<p>* sysdig -p &quot;%proc.name %fd.name&quot; &quot;evt.type=accept and proc.name!=httpd&quot;<p>See the files where apache spends the most time doing I&#x2F;O.<p>* sysdig -c topfiles_time proc.name=httpd<p>Show the network data that apache exchanged with 192.168.0.1.<p>* sysdig -A -c echo_fds fd.sip=192.168.0.1 and proc.name=httpd<p>Show every time a file is opened under &#x2F;etc.<p>* sysdig evt.type=open and fd.name contains &#x2F;etc
评论 #7524279 未加载
joshbaptisteabout 11 years ago
I would like to know what&#x27;s going more low level, Ktap gives a good break down how they differ from SystemTap, dynamically typed, byte-code design... etc<p><a href="http://www.ktap.org/doc/tutorial.html#faq" rel="nofollow">http:&#x2F;&#x2F;www.ktap.org&#x2F;doc&#x2F;tutorial.html#faq</a><p>Is Sysdig design similar?
评论 #7526033 未加载
zobzuabout 11 years ago
&quot;The definitive tool&quot; they name it, yet its not as powerful as dtrace. So, its not definitive.<p>Looks nice otherwise. Too bad it needs a kernel module.
评论 #7525493 未加载
评论 #7525260 未加载
yxhuvudabout 11 years ago
Ah, the good ol&#x27; pipe through sudo bash installation instructions. I wish there was a more structured platform independent way of distributing stuff before the stuff is packaged by distros.
评论 #7526052 未加载
评论 #7524602 未加载
评论 #7525106 未加载
simonebrunozziabout 11 years ago
Wow, this is really great. From the creator of Wireshark, nonetheless :)
评论 #7527858 未加载
krakensdenabout 11 years ago
Given that it involves a kernel module, I was kind of skeptical- but Greg KH seems to have looked it over and fixed it up, which I&#x27;d call a compelling seal of approval:<p><a href="https://github.com/draios/sysdig/commits/master/driver" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;draios&#x2F;sysdig&#x2F;commits&#x2F;master&#x2F;driver</a>
perryh2about 11 years ago
This tool is very similar to what I had created last summer as an intern (strace&#x2F;lsof analysis), but it seems to be a lot more rich in features. I analyzed system calls as well as application tracing (New Relic) to find&#x2F;fix performance bottlenecks.
评论 #7528027 未加载
mesuuttabout 11 years ago
I am getting error during compiling on Arch linux:<p><a href="https://github.com/draios/sysdig/issues/39" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;draios&#x2F;sysdig&#x2F;issues&#x2F;39</a><p>Has anyone encounter with this error before? Any help would be appreciated.
neuronsourcingabout 11 years ago
After installing sysdig, when I trying to run it I get the following error:<p># sysdig fd.type=ipv4<p>error creating the process list<p>Has anyone seen this one before? Any help would be appreciated.
评论 #7531698 未加载
digitalyatriabout 11 years ago
Some observations<p>sudo sysdig -w file1.log<p>file1.log contains lots of junk characters (fix this) ^@^@^@^@^@^@^@^@^@^@^@^@^<p>Better alternative<p>sudo sysdig &gt; file2.log<p>file has proper logs
评论 #7529574 未加载
评论 #7529547 未加载
pinturicabout 11 years ago
It is amazing how easy it seams to collect such information with this tool
wesleyacabout 11 years ago
Just looked at the website, and had a very &quot;small world&quot; feeling:<p>They&#x27;re located in my town O.o