sysdig是一個強(qiáng)大的開源工具，用于系統(tǒng)級別的分析,探測和排障，它的創(chuàng)建者在介紹它時稱之為“strace+tcpdump+lsof+上面點綴著lua櫻桃的絕妙醬汁”。拋開幽默不說，sysdig的最棒特性之一在于，它不僅能分析linux系統(tǒng)的“現(xiàn)場”狀態(tài)，也能將該狀態(tài)保存為轉(zhuǎn)儲文件以供離線檢查
sysdig - the definitive system and process troubleshooting tool sysdig is a tool for system troubleshooting, analysis and exploration. It can be used to capture, filter and decode system calls and other OS events. sysdig can be both used to inspect live systems, or to generate trace files that can be analyzed at a later stage. sysdig includes a powerul filtering language, has customizable output, and can be extended through Lua scripts, called chisels.
1、sysdig的安裝
系統(tǒng)版本信息如下
[root@VM_Server ~]# cat /etc/redhat-release
centos Linux release 7.6.1810 (Core) [root@VM_Server ~]# uname -r
3.10.0-957.el7.x86_64[root@VM_Server ~]# 
1)在線安裝
先配置好yum源
wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
sed -i "s/keepcache=0/keepcache=1/g" /etc/yum.conf
sed -i "s/gpgcheck=1/gpgcheck=0/g" /etc/yum.conf
腳本安裝sysdig
curl -s https://s3.amazonaws.com/download.draIOS.com/stable/install-sysdig | bash
2)離線安裝
rpm -Uvh zlib-devel-1.2.7-18.el7.x86_64.rpm
rpm -Uvh elfutils-*.rpm
rpm -Uvh dkms-2.8.1-4.20200214git5ca628c.el7.noarch.rpm
rpm -ivh sysdig-0.26.7-x86_64.rpm 
2、sysdig的使用
1、sysdig -cl （--list-chisels）列出可用的默認(rèn)類目
默認(rèn)有以下幾類
[root@VM_Server ~]# sysdig -clCategory: Application 應(yīng)用
Category: CPU Usage CPU使用量
Category: Errors 錯誤
Category: I/O
Category: Logs 日志
Category: Misc
Category: Net 網(wǎng)絡(luò)
Category: Performance 性能
Category: Security 安全
Category: System State 系統(tǒng)狀態(tài)
Category: Tracers
2、使用-i查看具體的信息
Use the -i flag to get detailed information about a specific chisel
[root@VM_Server ~]# sysdig -i topprocs_file
Category: I/O
-------------
topprocs_file Top processes by R+W disk bytes
Shows the top processes in terms of total (in+out) bytes to disk. This chisel i
s compatible with containers using the sysdig -pc or -pcontainer argument, othe
rwise no container information will be shown.
Args:
(None)
3、用法舉例
1)監(jiān)控交互用戶活動用法舉例
作為系統(tǒng)管理員想要監(jiān)控系統(tǒng)中交互的用戶活動（如，用戶在命令行輸入了什么命令，以及用戶去了什么目錄），這時可以用spy_user “-z” （與“-w”一起使用）為記錄文件啟用壓縮
-z, --compress Used with -w, enables compression for trace files
“-w ”保存sysdig記錄到指定的文件
-w, --write=Write the captured events to.
-r, --read=Read the events from.
mkdir -p /log/sysdig/
sysdig -z -w /log/sysdig/spy_users.sysdigcap.gz -c spy_users
例如yuanfan這個用戶登錄SSH后執(zhí)行了如下命令
sysdig -c spy_users可以監(jiān)控到這個用戶的操作命令
-r, --read=Read the events from.
sysdig -r /log/sysdig/spy_users.sysdigcap.gz -c spy_users 
2）查看占用網(wǎng)絡(luò)帶寬最多的進(jìn)程
sysdig -c topprocs_net
3）查看R+W讀寫量最大的文件
sysdig -c topfiles_bytes
4)查看CPU占用量最大的進(jìn)程
sysdig -c topprocs_cpu
4、總結(jié)
sysdig是一個非常強(qiáng)大的工具，本文篇幅有限，其它具體用法可以參考如下幾個鏈接或者自行查閱官方文檔
1）https://www.oschina.net/p/sysdig
2）http://www.361way.com/linux-sysdig/4912.html
3）https://github.com/draios/sysdig/wiki/sysdig-user-guide
