sysdig

No entries match these filters. Clear filters

1. 0.40.0 Feb 22, 2025 · release notes

   Supports linking to shared falcosecurity libraries.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.40.0 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.40.0

2. 0.38.0 Jun 17, 2024 · release notes

   sysdig v0.38.0 adds NO_COLOR support and modern BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. build default

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.38.0 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.38.0

   └──▷ TRY IT
   Run sysdig with plain text output for piping to log viewers that don't support ANSI codes
   copy

   $ NO_COLOR=1 sysdig proc.name==bash

   • Adds NO_COLOR environment variable support to disable colored output
   • Changes the build default to always enable modern BPF via CMake

   2 details in Everything

3. 0.37.0 May 13, 2024 · release notes

   Adds driver configs for kernel 7.1.0 support and fixes podman SCAP support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.37.0 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.37.0

   • Adds driver configs for kernel version 7.1.0
   • Applies patch to enable podman on SCAP files

   2 details in Everything

4. 0.36.1 Apr 19, 2024 · release notes

   Adds chisels for filtering and analyzing system events

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.36.1 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.36.1

   • Adds the chisels feature for event filtering and analysis

   1 detail in Everything

5. 0.32.0 Jul 3, 2023 · release notes

   Sysdig 0.32.0 promotes the modern BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. probe to stable status and updates driver/libs.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.32.0 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.32.0

   • The modern BPF probe is no longer an experimental feature

   1 detail in Everything

6. 0.31.3 Mar 20, 2023 · release notes

   Introduces the modern eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. probe for sysdig userspace

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.31.3 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.31.3

7. 0.30.0 Oct 21, 2022 · release notes

   Adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. multiarch packages, updated plugin API 2.0, and improved plugin loading info in v0.30.0.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.30.0 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.30.0

   • Support for ARM64: multiarch packages, container images, and prebuilt-drivers (to be used with scap-driver-loader)
   • Updated plugin API support to latest 2.0.0 version
   • More expressive plugin loading experience: detailed info, suggestions on which plugins to be loaded

   3 details in Everything

8. 0.29.0 Mar 30, 2022 · release notes

   sysdig 0.29.0 adds plugins support with colored output, Podman detection, and new syscalls.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.29.0 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.29.0

   └──▷ USE IT
   Scan the last 10 events using a dummy plugin with start/stop parameters.
   shell copy

   sysdig -I dummy:'{"start":1,"maxEvents":10}'

   Register source and input plugins via their respective CLI flags with init/open params.
   shell copy

   sysdig -H dummy:'{"jitter":50}' -I dummy:'{"start":1,"maxEvents":10}'

   • Adds --plugin-config-file CLI argument to load plugins via a Falco plugin configuration file
   • Adds -H <source_plugin_config> CLI option to load and register a source plugin with init config
   • Adds -I <input_plugin_config> CLI option to use an input plugin as the event source
   • Adds support for Podman containers in libscap
   • Adds mprotect, execveat, copy_file_range, and clone3 syscalls to the kernel driver

   +1 more show less

   • Adds colored output formatting for plugins

   6 details in Everything

9. 0.28.0 Dec 16, 2021 · release notes

   Sysdig 0.28.0 adds native ANSI color support to event string formatting and shifts release system to GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.28.0 https://github.com/draios/sysdig.git
   # already have the repo? check out this version:
   $ git checkout 0.28.0

   • event string formatting now supports colors by default via ANSI escape codes when the terminal allows it

   1 detail in Everything

10. 0.27.1 Oct 2, 2020 · release notes

    Adds -DMINIMAL_BUILD and -DMUSL_OPTIMIZED_BUILD CMake flags for stripped-down and Alpine static builds in Sysdig 0.27.1.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.27.1 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.27.1

    └──▷ TRY IT
    Build a minimal Sysdig binary that excludes heavy dependencies like eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. and container support for constrained environments.
    copy

    $ cmake -DMINIMAL_BUILD=On ..

    Compile Sysdig with static musl linking optimized for Alpine Linux deployment.
    copy

    $ cmake -DMUSL_OPTIMIZED_BUILD=On ..

    • Adds MINIMAL_BUILD CMake option to exclude kubernetes, kernel module, eBPF, and container support from the build
    • Adds MUSL_OPTIMIZED_BUILD CMake option to enable static linking with musl on Alpine Linux

    2 details in Everything

11. 0.27.0 Aug 10, 2020 · release notes

    sysdig 0.27.0 adds userspace instrumentation, renameat2 support, new filter for open+create, and parent PID in v_procs chisel

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.27.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.27.0

    • Adds Userspace instrumentation support via the pdig tooling surface.
    • Adds renameat2 syscall instrumentation.
    • Adds a new filter matching open+create or create events with exec permissions.
    • Adds parent PID (ppid) field to the v_procs chisel.

    4 details in Everything

12. 0.26.6 Mar 30, 2020 · release notes

    Sysdig 0.26.6 adds support for s390x and ppc64le architectures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.26.6 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.26.6

13. 0.26.3 Aug 19, 2019 · release notes

    sysdig 0.26.3 adds chmod filler and per-cpuset Docker CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage reporting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.26.3 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.26.3

    • Added fillers for chmod syscalls to enable filtering on file permission changes
    • Added support for reporting CPU usage per Docker cpuset to isolate resource consumption by container group

    2 details in Everything

14. 0.26.2 Aug 6, 2019 · release notes

    Adds support for Kubernetes liveness/readiness probes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.26.2 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.26.2

15. 0.26.0 May 22, 2019 · release notes

    v0.26.0 adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 UTC timestamps, major/minor device numbers for fd events, CRI-O metadata caching, and BPM container type support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.26.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.26.0

    └──▷ USE IT
    Inspect the major and minor device numbers for file descriptors in a capture to identify specific disk partitions or block devices.
    shell copy

    sysdig -p '%fd.num,%fd.typeinfo.major,%fd.typeinfo.minor' 'fd.type=file'

    • Support time field in ISO 8601 UTC format
    • Support major/minor device numbers for file descriptor events

    2 details in Everything

16. 0.25 Apr 3, 2019 · release notes

    Adds CRI container runtime support and Linux 5.0 kernel compatibility

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.25 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.25

    • Adds CRI (Container Runtime Interface) support for detecting pod sandbox containers and integrating with containerd and CRI-O

    1 detail in Everything

17. 0.24.2 Dec 21, 2018 · release notes

    Adds big snaplen capture for specific ports in sysdig

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.24.2 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.24.2

    • Adds the ability to specify a set of ports where data is captured with bigger snaplen (20000)

    1 detail in Everything

18. 0.24.0 Oct 4, 2018 · release notes

    Sysdig 0.24.0 adds user.loginuid, domain name resolution fields, endswith filter, and full IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.24.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.24.0

    └──▷ USE IT
    Filter sysdig output for connections resolved by domain name, which was not previously possible.
    shell copy

    sysdig -s2048 fd.ip.name=example.com

    Track the original login user across sudo/su sessions using the new loginuid field.
    shell copy

    sysdig -s2048 user.loginuid=1000

    Use the new endswith operator to match file paths ending in a specific extension.
    shell copy

    sysdig -s2048 f.name endswith '.log'

    • Adds loginuid support with new fields user.loginuid & user.loginname
    • Track connections by domain name via new fields fd.*ip.name
    • Add endswith filter to support suffix matching on strings
    • Add minikube support to the kernel module probe loader script

    4 details in Everything

19. 0.23.0 Aug 9, 2018 · release notes

    Adds elapsed time logging for tracers and improves capture format flexibility in sysdig

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.23.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.23.0

20. 0.22.0 Jul 13, 2018 · release notes

    sysdig 0.22.0 adds beta eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. backend, custom container types, and SYSDIG_VERSION env var for docker builds.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.22.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.22.0

    └──▷ USE IT
    Run sysdig-probe-loader to load a kernel module from a custom HTTP source instead of the default location.
    shell copy

    sysdig-probe-loader -e SYSDIG_PROBE_URL=http://custom-server.com/module.ko

    Build a sysdig docker image using a specific version defined by the environment variable.
    shell copy

    SYSDIG_VERSION=0.22.0 docker build -t my-sysdig .

    • Adds eBPF as the instrumentation backend in kernel space (beta)
    • Introduces -e SYSDIG_PROBE_URL=<url> argument to sysdig-probe-loader for custom kernel module URLs
    • Adds ability to ignore events by process name (comm) at the scap level
    • Extends container_manager with callbacks for new and removed containers
    • Enables custom container types alongside Docker on the sinsp level

    +2 more show less

    • Adds parsing and storage of repository, tag, and digest fields in container_info
    • Adds SYSDIG_VERSION environment variable to directly set the sysdig version when creating the docker image

    7 details in Everything

21. 0.21.0 Mar 29, 2018 · release notes

    sysdig 0.21.0 adds fd.connected and fd.name_changed filterchecks, s390x Docker support, and pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. versioning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.21.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.21.0

    └──▷ USE IT
    Filter only network connections that are actively bound to a remote endpoint, excluding unconnected UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. sockets.
    shell copy

    sysdig fd.connected=true

    Detect events where the connection information for an existing file descriptor changes, such as UDP connect() calls.
    shell copy

    sysdig fd.name_changed=true

    Increase the thread table capacity via API for high-thread-count workloads.
    code copy

    sinsp::set_max_thread_table_size(1024)

    • Adds fd.connected filtercheck to determine if a network fd is bound to a remote endpoint
    • Adds fd.name_changed filtercheck that is true when an event changes the connection information for a connection fd
    • Adds s390x as a platform using Docker
    • Increments pcap major/minor version in capture files for incompatible event types and fields
    • Stores mesos-related environment information for the first process in the container when saving container info

    +3 more show less

    • Makes thread table size configurable via sinsp::set_max_thread_table_size()
    • Adds support for new AWS Linux 2 AMI
    • Adds process group id to execve events

    8 details in Everything

22. 0.20.0 Jan 19, 2018 · release notes

    Adds raw socket support, bpf/seccomp syscall handling, and optimized container scanning in sysdig 0.20.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.20.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.20.0

    • Add the ability to parse and represent RAW sockets
    • Add support for bpf/seccomp syscalls
    • Handle finit_module syscall
    • Reduce inactive container scan time from 20 minutes to 30 seconds

    4 details in Everything

23. 0.19.0 Oct 4, 2017 · release notes

    Adds per-cpu counters to tracepoint events in Sysdig 0.19.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.19.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.19.0

24. 0.18.0 Sep 22, 2017 · release notes

    Adds container events to captures and new proc.exepath filter field

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.18.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.18.0

    • Add container start/stop events to capture files via new container event type
    • Make executable path filterable and displayable with new proc.exepath field

    2 details in Everything

25. 0.17.0 Jul 24, 2017 · release notes

    Adds netlink socket support for sysdig

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.17.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.17.0

    • Support netlink sockets

    1 detail in Everything

26. 0.16.0 May 8, 2017 · release notes

    sysdig 0.16.0 adds undecode syscall decoding and changes default network port handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.16.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.16.0

    └──▷ USE IT
    Enable server port decoding to see which ports are being connected to from the server side
    shell copy

    sysdig -R

    • Changes default network port decoding behavior; server ports are now hidden by default requiring -R to re-enable

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Server port decoding is now disabled by default; use the -R flag to restore previous behavior where server ports were decoded
27. 0.15.0 Feb 24, 2017 · release notes

    sysdig 0.15.0 adds Linux Kernel 4.10 support and uses /proc/pid/status for process vpid.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.15.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.15.0

    • Changes process vpid retrieval to use /proc/<pid>/status for kernels >= 4.1

    1 detail in Everything

28. 0.14.0 Jan 23, 2017 · release notes

    sysdig 0.14.0 adds proc.pcmdline filter and newline-delimited JSON output format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.14.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.14.0

    • --json output is now a stream of single JSON objects per event separated by newlines instead of a single JSON array
    • New filter proc.pcmdline exposes the full parent process command line

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--json output format changes from a JSON array to newline-delimited objects, breaking parsers expecting an array wrapper
29. 0.13.0 Dec 20, 2016 · release notes

    sysdig 0.13.0 adds support for concatenated capture files and evtin.* fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.13.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.13.0

    └──▷ USE IT
    Filter sysdig output using the new event input fields to trace network packet sources.
    shell copy

    sysdig evtin.src_port=80

    Read a series of sysdig capture files (e.g., from a segmented disk or pipeline) as a single stream.
    shell copy

    sysdig -r part1.scap part2.scap

    • evtin.* fields can be used also for displaying now
    • Ability to open concatenated capture files

    2 details in Everything

30. 0.12.0 Oct 25, 2016 · release notes

    Sysdig 0.12.0 adds container.*, k8s.* filters and glob/pmatch operators for shell-style matching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.12.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.12.0

    • Adds container.mount.* filter to match container mount points
    • Adds container.privileged filter to match containers running in privileged mode
    • Adds k8s.deployment.* and k8s.rs.* filters for Kubernetes support
    • Adds glob operator for shell-style string pattern matching
    • Adds pmatch operator

    5 details in Everything

31. 0.11.0 Jul 14, 2016 · release notes

    sysdig 0.11.0 adds user-level tracers and new csysdig views/filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.11.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.11.0

    • Support for tracers to add user level events to sysdig stream
    • New csysdig views: Traces List, Traces Summary, Traces Spectogram
    • New evtin.* and span.* filters
    • startswith operand for string filtering (e.g., fd.name startswith /etc)
    • evt.is_open_read and evt.is_open_write fields to detect read/write open events

    5 details in Everything

32. 0.10.0 Jun 8, 2016 · release notes

    sysdig 0.10.0 adds setsid event, proc.sid/proc.sname filters, and terminal compatibility flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.10.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.10.0

    └──▷ TRY IT
    Run sysdig with terminal compatibility mode for better output in PuTTY.
    copy

    $ sysdig --force-term-compat proc.name=ls

    Filter events by the process session ID to isolate a specific session's activity.
    copy

    $ sysdig proc.sid=<session_id>

    Monitor file writes only for processes belonging to a specific session leader name.
    copy

    $ sysdig evt.type=open and proc.sname=bash

    • --force-term-compat command line option to improve terminal settings for terminals like putty
    • setsid event captured by sysdig
    • proc.sid filter field to query the session id of the process generating the event
    • proc.sname filter field to query the name of the current process session leader

    4 details in Everything

33. 0.9.0 Apr 6, 2016 · release notes

    Adds Mesos/Marathon support, case-insensitive filters, Kubernetes bearer auth, and network CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.9.0

    • Adds Mesos Tasks, Mesos Frameworks, Marathon Apps, and Marathon Groups views in csysdig plus -m and -pm CLI flags for Mesos/Marathon integration
    • Adds mesos.task.name, mesos.task.id, marathon.app.name and other Mesos/Marathon filter fields to enable filtering by framework and application metadata
    • Adds the fd.net, fd.cnet, fd.snet, fd.lnet, and fd.rnet network filter fields supporting CIDR notation (e.g. 127.0.0.1/24) for precise network scope filtering
    • Adds the icontains filter comparison operator for case-insensitive string matching in sysdig filters
    • Adds -K support for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. based authentication and bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. authentication against the Kubernetes API server, enabling secure cluster monitoring

    +1 more show less

    • Adds lsof and renice new actions on csysdig views to inspect open file descriptors or adjust process priority from within the UI

    6 details in Everything

34. 0.8.0 Feb 4, 2016 · release notes

    Adds rkt and chroot event support plus container.type field in sysdig 0.8.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.8.0

    └──▷ TRY IT
    Run sysdig to monitor container events, filtering specifically for those managed by the rkt runtime.
    copy

    $ sysdig -l "container.type=rkt"

    When running sysdig inside a Docker container to monitor rkt hosts, mount the rkt library directory.
    copy

    $ docker run -v /var/lib/rkt:/host/var/lib/rkt:ro ... sysdig

    • Adds rkt support for capturing containers managed by rkt when sysdig runs in a container
    • Captures chroot events from the kernel
    • Exposes the container.type field (e.g., docker, rkt) in event metadata

    3 details in Everything

35. 0.7.0 Jan 22, 2016 · release notes

    Adds csysdig spectrogram views, Kubernetes certificate auth via env var/sysflag, filter-proclist flag, and latency event fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.7.0

    └──▷ USE IT
    Authenticate to Kubernetes using a client certificate without interactive prompts.
    shell copy

    sysdig -K /path/to/client.crt --k8s-api-cert=/path/to/ca.crt

    Limit a capture to 60 seconds for automated scripts.
    shell copy

    sysdig -M 60 -w capture.scap

    Filter the process list in csysdig to show only high-IO processes.
    shell copy

    csysdig --filter-proclist 'evt.io > 1024'

    • Adds spectro_all (System call latency spectrogram) and spectro_file (File I/O latency spectrogram) views to csysdig
    • Adds -K <file_name> / --k8s-api-cert=<file_name> CLI flags and SYSDIG_K8S_API_CERT environment variable for Kubernetes API server certificate authentication
    • Adds --filter-proclist flag to apply filters to the process table in csysdig
    • Adds -M <seconds> flag to stop collecting after a specified duration
    • Introduces evt.latency.quantized field as 10-base log of enter/exit event delta

    +1 more show less

    • Introduces evt.latency.human field as human-readable string of enter/exit event delta

    6 details in Everything

36. 0.6.0 Dec 14, 2015 · release notes

    0.6.0 adds access and semget system event support plus full Kubernetes trace saving.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.6.0

    • Adds access system event capture
    • Adds semget system event capture
    • Adds automatic sysdig-probe build for boot2docker releases

    3 details in Everything

37. 0.5.0 Nov 6, 2015 · release notes

    sysdig 0.5.0 adds --k8s-api, -pk format, and Kubernetes-specific display fields for cluster-wide visibility

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.5.0

    └──▷ USE IT
    Connect sysdig to a managed K8s API server and output pod-level details in a format optimized for Kubernetes clusters.
    shell copy

    sysdig --k8s-api https://cluster-api.example.com -pk

    Filter sysdig output to show only events from pods with a specific label in the production namespace.
    shell copy

    sysdig 'k8s.ns.name=production and k8s.pod.label.env=prod'

    • Adds the --k8s-api CLI flag to specify a Kubernetes API server endpoint directly from the command line.
    • Introduces the -pk command-line option for Kubernetes-friendly output format in sysdig's capture output.
    • Adds new display/filter fields k8s.pod.name, k8s.pod.id, k8s.pod.label, k8s.pod.labels, k8s.rc.name, k8s.rc.id, k8s.rc.label, k8s.rc.labels, k8s.svc.name, k8s.svc.id, k8s.svc.label, k8s.svc.labels, k8s.ns.name, k8s.ns.id, k8s.ns.label, and k8s.ns.labels for granular Kubernetes metadata extraction.
    • Brings new csysdig views: Kubernetes Controllers, Kubernetes Namespaces, Kubernetes Pods, and Kubernetes Services.

    4 details in Everything

38. 0.3.0 Oct 13, 2015 · release notes

    Adds memcachelog chisel, backlog csysdig view, and --unbuffered flag in sysdig 0.3.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.3.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.3.0

    └──▷ USE IT
    Capture and analyze memcached get/set operations in real-time.
    shell copy

    sysdig -A -c memcachelog

    Launch csysdig and switch to the new backlog view to monitor process queue depths.
    shell copy

    csysdig --view backlog

    • Adds the memcachelog chisel to show memcached command logs (get/set)
    • Adds the backlog csysdig view for monitoring queue utilization per process
    • Adds the --unbuffered CLI flag to disable output buffering

    3 details in Everything

39. 0.2.0 Sep 15, 2015 · release notes

    Adds six new fd.proto filter fields and three new syscall event types in sysdig 0.2.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.0 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.2.0

    └──▷ TRY IT
    Capture only TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections from the local process to an external server
    copy

    $ sysdig fd.lproto=tcp

    • Adds fd.proto, fd.cproto, fd.sproto, fd.lproto, and fd.rproto filter fields for matching TCP/UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. client, server, local, and remote protocols
    • Adds support for new semop, semctl, and ppoll syscall events

    2 details in Everything

40. 0.1.103 Aug 21, 2015 · release notes

    Adds httplog and httptop chisels, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. hotplug events, and EL5 probe compilation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.103 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.103

    • Adds httplog chisel to show a log of all HTTP requests
    • Adds httptop chisel to show top HTTP requests by ncalls, time or bytes

    2 details in Everything

41. 0.1.102 Jul 30, 2015 · release notes

    Adds sysdig -C, -e, -W, and -G flags to rotate tracing files during capture

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.102 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.102

    └──▷ USE IT
    Capture events with automatic file rotation every 100MB, 10 files max, with gzip compression and 5-second interval.
    shell copy

    sysdig -C 100 -e 10 -W -G 5

    • Adds -C, -e, -W, and -G flags to rotate tracing files when capturing
    • Supports decoding setns and flock syscalls
    • Parses O_CLOEXEC flag on open and related syscalls
    • Parses CLONE_NEWUSER flag on clone

    4 details in Everything

42. 0.1.100 May 21, 2015 · release notes

    sysdig 0.1.100 adds support for intercepting signals via the signaldeliver event

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.100 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.100

    • signaldeliver event: new capability to capture signal delivery details including source PID, destination PID, and signal type
    • echo_fds chisel: improved formatting output

    2 details in Everything

43. 0.1.99 Mar 16, 2015 · release notes

    Adds concurrent sysdig instance support and exists/in filter clauses.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.99 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.99

    └──▷ TRY IT
    Check if a field has a value before acting on it to avoid false positives.
    copy

    $ sysdig proc.name exists

    Filter events by checking if the event type is one of several specific system calls.
    copy

    $ sysdig "evt.type in ( 'select', 'poll' )"

    • spy_users chisel accuracy improved
    • sysdig can now be concurrently opened multiple times
    • Adds exists clause for filters, e.g. sysdig proc.name exists
    • Adds in clause for filters, e.g. sysdig "evt.type in ( 'select', 'poll' )"

    4 details in Everything

44. 0.1.98 Mar 2, 2015 · release notes

    sysdig 0.1.98 adds container support, -pc flag, new filter fields, and sysdig-probe-loader script

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.98 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.98

    └──▷ USE IT
    Get container-aware output for events using the new flag
    shell copy

    sysdig -pc proc.name=bash

    Use the new environment variable to point sysdig to the host's /proc inside a container
    shell copy

    SYSDIG_HOST_ROOT=/host/proc sysdig -pcontainer

    Filter events using the new container-related filter fields
    shell copy

    sysdig container.name=nginx and thread.cgroup.cpuacct > 0

    • -pc or -pcontainer flags for container-friendly output format
    • SYSDIG_HOST_ROOT environment variable to set alternate /proc root in containers
    • thread.cgroups, thread.cgroup, thread.vtid, proc.vpid, container.id, container.name, container.image filter fields
    • sysdig-probe-loader script for loading the probe module in atypical environments
    • build-sysdig-probe-binaries script to prebuild and upload sysdig-probe binaries to S3

    5 details in Everything

45. 0.1.97 Feb 23, 2015 · release notes

    Adds bash autocompletion for --chisel and --chisel-info flags and new subsecoffset chisel

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.97 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.97

    • Introduces subsecoffset chisel to visualize subsecond offset time of system call execution

    1 detail in Everything

46. 0.1.94 Jan 20, 2015 · release notes

    sysdig 0.1.94 adds get_terminal_info chisel API, evt.buflen filter, and comm param for clone/execve/fork/vfork events

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.94 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.94

    └──▷ USE IT
    Filter system calls by their buffer length using the new field.
    shell copy

    sysdig evt.buflen > 1024

    Capture the executable command name for fork/exec events instead of relying on argv.
    shell copy

    sysdig -c fdtime_by comm evt.type in (clone, execve, fork, vfork)

    • Adds get_terminal_info to the chisel API function set.
    • Adds evt.buflen as a new filter field.
    • Enables clone, execve, fork, and vfork events to return the comm parameter for the executable file name.

    3 details in Everything

47. 0.1.93 Dec 17, 2014 · release notes

    sysdig 0.1.93 adds -E/--exclude-users flag and new event support for file descriptors, file operations, and user/group ID changes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.93 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.93

    • Buffer rendering on screen is now limited to 80 bytes unless -v is used
    • New events: procexit (returns thread exit code), sendfile, quotactl, setresuid, setresgid, setuid, setgid, getgid, getegid, getuid, geteuid
    • echo_fds chisel now prints the process name in its header

    3 details in Everything

48. 0.1.89 Sep 25, 2014 · release notes

    sysdig 0.1.89 adds --print-base64 flag and proc.env filter field

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.89 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.89

    • Adds --print-base64 CLI flag to print data buffers in base64 encoding
    • Introduces proc.env filter field to access process environment variables
    • Adds spy_file chisel to intercept all file read and write operations
    • Adds shellshock_detect chisel to detect shellshock injection attempts

    4 details in Everything

49. 0.1.88 Aug 20, 2014 · release notes

    sysdig 0.1.88 adds -tD timing flag, chisel API for thread tables, and new chisels for process/network introspection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.88 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.88

    └──▷ TRY IT
    Capture events but only print timing deltas relative to the last matching event for faster filtering analysis.
    copy

    $ sysdig -tD evt.type=connect

    Retrieve the process table within a chisel script to analyze process hierarchy or state programmatically.
    lua copy

    local threads = sysdig.get_thread_table()
    for id, thread in pairs(threads) do
      print(id .. ' ' .. thread.name)
    end

    • Adds -tD command line option to print relative time from the previous event matching a filter
    • Exposes sysdig’s thread table to chisels via sysdig.get_thread_table API function
    • Adds netstat chisel to print system network connections similar to standard netstat
    • Adds lsof chisel to print open file descriptors for every process
    • Adds ps chisel to list running processes

    +1 more show less

    • Enables <, <=, > and >= operators for network port comparison in filters

    6 details in Everything

50. 0.1.87 Aug 6, 2014 · release notes

    Adds --fatfile flag, new chisels (lsof, around, spy_logs), and syslog/ptrace event support in v0.1.87

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.87 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.87

    └──▷ USE IT
    Capture events around a specific command execution to debug startup issues
    shell copy

    sysdig -s 2048 -w output.fatfile --fatfile 'proc.name=bash'

    Filter events specifically to syslog messages with facility and severity details
    shell copy

    sysdig -c spy_syslog evt.is_syslog=true syslog.facility.str=kern

    Intercept logs written by a running application to debug log formatting issues
    shell copy

    sysdig -c spy_logs 'fd.name contains ".log"'

    • Adds --fatfile CLI option to include hidden reconstruction events in output files
    • Adds lsof chisel to print open file descriptors for every process
    • Adds around chisel to save events within a time range around filter matches
    • Adds spy_logs chisel to intercept and pretty-print writes to .log or _log files
    • Adds spy_syslog chisel (replaces echo_syslog) to print every message written to syslog

    +2 more show less

    • Adds evt.around, evt.is_syslog, and new syslog.* filter fields for enhanced event filtering
    • Adds support for the ptrace event type

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !echo_syslog chisel is replaced by spy_syslog; scripts using the old name will fail.
51. 0.1.86 Jul 22, 2014 · release notes

    sysdig 0.1.86 adds the echo_syslog chisel to print syslog messages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.86 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.86

    • Many minor bugfixes

    1 detail in Everything

52. 0.1.85 Jul 8, 2014 · release notes

    sysdig 0.1.85 installs bash and zsh shell completions by default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.85 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.85

    • bash completion is installed by default

    1 detail in Everything

53. 0.1.84 Jun 25, 2014 · release notes

    Adds splice event support and new proc filter fields (proc.apid, proc.aname, proc.loginshellid) in sysdig 0.1.84.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.84 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.84

    • Adds support for the splice event, allowing capture and filtering of file data splicing operations
    • Adds proc.apid filter field to retrieve the PID of a process ancestor
    • Adds proc.aname filter field to retrieve the name (excluding path) of a process ancestor
    • Adds proc.loginshellid filter field to retrieve the PID of the oldest shell among a process's ancestors
    • Adds hierarchical support for the spy_users chisel

    5 details in Everything

54. 0.1.83 May 31, 2014 · release notes

    sysdig 0.1.83 adds new chisel support and expanded filter fields for process memory, file descriptors, and page faults.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.83 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.83

    └──▷ TRY IT
    Filter sysdig output to show only processes that have opened more than 100 file descriptors using the new proc.fdopencount field.
    copy

    $ sysdig -p '%proc.name %proc.fdopencount' 'proc.fdopencount > 100'

    Trace memory mapping events like mmap and munmap to monitor how processes allocate and free virtual memory.
    copy

    $ sysdig -p '%evt.time %proc.name %evt.arg.addr %evt.arg.len' evt.type in (mmap, munmap)

    Monitor page faults for a specific thread using the new thread.pfmajor and thread.pfminor fields.
    copy

    $ sysdig -p '%evt.time %proc.name %thread.id %thread.pfmajor %thread.pfminor' evt.type in (pfmajor, pfminor)

    • Adds support for the mmap, mmap2, munmap, and brk events in sysdig traces
    • Introduces new filter fields: proc.vmsize, proc.vmrss, proc.vmswap, thread.pfmajor, thread.pfminor, proc.fdopencount, proc.fdlimit, and proc.fdusage

    2 details in Everything

55. 0.1.82 May 8, 2014 · release notes

    Adds new chisels proc_exec_time and scallslower, plus the proc.duration filter field.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.82 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.82

    • Adds proc_exec_time chisel to show process execution time
    • Adds scallslower chisel to trace slow syscalls
    • Adds proc.duration filter field for number of nanoseconds since the process started

    3 details in Everything

56. 0.1.81 Apr 30, 2014 · release notes

    sysdig 0.1.81 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./Raspberry PI support, new chisel/filter fields, multi-file trace reading, and compressed output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.81 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.81

    └──▷ USE IT
    Filter events by a specific filename using the new fd.filename field.
    shell copy

    sysdig fd.filename=example.log

    Read multiple trace files in a single sysdig session.
    shell copy

    sysdig -r trace1.trace -r trace2.trace

    Capture and save a trace file in compressed format to save disk space.
    shell copy

    sysdig -z -w output.trace

    • Adds ARM architecture support (tested on Raspberry PI)
    • Adds fileslower.lua chisel
    • Adds fd.filename filter field
    • Enables -r to open multiple files simultaneously
    • Adds -z flag to write compressed trace files

    5 details in Everything

57. 0.1.79 Apr 11, 2014 · release notes

    Sysdig 0.1.79 adds spy_port chisel, new fd/proc fields, grsecurity/Solaris support, and -D self-detection toggle.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.79 https://github.com/draios/sysdig.git
    # already have the repo? check out this version:
    $ git checkout 0.1.79

    • Adds spy_port chisel for port activity analysis
    • Adds fd.directory field to filter by file descriptor directory path
    • Adds proc.ppid field to filter by parent process ID
    • Enables support for grsecurity-patched kernels
    • Enables building on Solaris platforms

    +1 more show less

    • sysdig -D now excludes sysdig's own self-detection by default

    6 details in Everything