Sysdig analysis container system call

sysdig brief introduction

Project address : https://github.com/draios/sysdig

install sysdig

# Import draios Public key 
rpm --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public

#  download draios Of repo Source 
curl -s -o /etc/yum.repos.d/draios.repo http://download.draios.com/stable/rpm/draios.repo

#  install epel Source 
yum install epel-release -y
 
#  install sysdig And dependency packages 
## sysdig rely on kernel-devel and dkms( Dynamic kernel module support )
### DKMS The full name is Dynamic Kernel Module Support （ Dynamic kernel module support ）, That is, after the kernel version changes, the new driver module can be automatically regenerated .
yum -y install kernel-devel* dkms sysdig

Load driver module

#  Load driver module -- to update Linux The kernel may need to be re run 
/usr/bin/scap-driver-loader

#  Check whether the kernel module is loaded 
lsmod |grep scap

sysdig Common parameters

sysdig Filter

Common field

Utilities