sysdig是一個強大的開源工具，用于系統級別的分析,探測和排障，它的創建者在介紹它時稱之為“strace+tcpdump+lsof+上面點綴著lua櫻桃的絕妙醬汁”。拋開幽默不說，sysdig的最棒特性之一在于，它不僅能分析linux系統的“現場”狀態，也能將該狀態保存為轉儲文件以供離線檢查
sysdig - the definitive system and process troubleshooting tool sysdig is a tool for system troubleshooting, analysis and exploration. It can be used to capture, filter and decode system calls and other OS events. sysdig can be both used to inspect live systems, or to generate trace files that can be analyzed at a later stage. sysdig includes a powerul filtering language, has customizable output, and can be extended through Lua scripts, called chisels.
1、sysdig的安裝
系統版本信息如下
[root@VM_Server ~]# cat /etc/redhat-release
centos Linux release 7.6.1810 (Core) [root@VM_Server ~]# uname -r
3.10.0-957.el7.x86_64[root@VM_Server ~]# 
1)在線安裝
先配置好yum源
wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
sed -i "s/keepcache=0/keepcache=1/g" /etc/yum.conf
sed -i "s/gpgcheck=1/gpgcheck=0/g" /etc/yum.conf
腳本安裝sysdig
curl -s https://s3.amazonaws.com/download.draIOS.com/stable/install-sysdig | bash
2)離線安裝
rpm -Uvh zlib-devel-1.2.7-18.el7.x86_64.rpm
rpm -Uvh elfutils-*.rpm
rpm -Uvh dkms-2.8.1-4.20200214git5ca628c.el7.noarch.rpm
rpm -ivh sysdig-0.26.7-x86_64.rpm 
2、sysdig的使用
1、sysdig -cl （--list-chisels）列出可用的默認類目
默認有以下幾類
[root@VM_Server ~]# sysdig -clCategory: Application 應用
Category: CPU Usage CPU使用量
Category: Errors 錯誤
Category: I/O
Category: Logs 日志
Category: Misc
Category: Net 網絡
Category: Performance 性能
Category: Security 安全
Category: System State 系統狀態
Category: Tracers
2、使用-i查看具體的信息
Use the -i flag to get detailed information about a specific chisel
[root@VM_Server ~]# sysdig -i topprocs_file
Category: I/O
-------------
topprocs_file Top processes by R+W disk bytes
Shows the top processes in terms of total (in+out) bytes to disk. This chisel i
s compatible with containers using the sysdig -pc or -pcontainer argument, othe
rwise no container information will be shown.
Args:
(None)
3、用法舉例
1)監控交互用戶活動用法舉例
作為系統管理員想要監控系統中交互的用戶活動（如，用戶在命令行輸入了什么命令，以及用戶去了什么目錄），這時可以用spy_user “-z” （與“-w”一起使用）為記錄文件啟用壓縮
-z, --compress Used with -w, enables compression for trace files
“-w ”保存sysdig記錄到指定的文件
-w, --write=Write the captured events to.
-r, --read=Read the events from.
mkdir -p /log/sysdig/
sysdig -z -w /log/sysdig/spy_users.sysdigcap.gz -c spy_users
例如yuanfan這個用戶登錄SSH后執行了如下命令
sysdig -c spy_users可以監控到這個用戶的操作命令
-r, --read=Read the events from.
sysdig -r /log/sysdig/spy_users.sysdigcap.gz -c spy_users 
2）查看占用網絡帶寬最多的進程
sysdig -c topprocs_net
3）查看R+W讀寫量最大的文件
sysdig -c topfiles_bytes
4)查看CPU占用量最大的進程
sysdig -c topprocs_cpu
4、總結
sysdig是一個非常強大的工具，本文篇幅有限，其它具體用法可以參考如下幾個鏈接或者自行查閱官方文檔
1）https://www.oschina.net/p/sysdig
2）http://www.361way.com/linux-sysdig/4912.html
3）https://github.com/draios/sysdig/wiki/sysdig-user-guide
