# Sysdig

Linux system exploration and troubleshooting tool with first class support for containers

Repository: https://github.com/draios/sysdig
Canonical: https://ross.abutalabs.com/products/sysdig
Homepage: http://www.sysdig.com/
Language: C++
License: NOASSERTION
License Family: other
Last push: 2026-04-13T12:32:03+00:00
Link (homepage): http://www.sysdig.com/
Link (site_page): https://www.sysdig.com/integrations
Link (site_page): https://www.sysdig.com/about
Link (site_page): https://docs.sysdig.com/en

## Health v2 (maintenance only)
Score: 78/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 77, release rhythm 68, longevity 100
- inputs: {"age_days": 4613, "days_push": 142, "days_rel": 216, "gap_med": 12, "n_releases_24m": 8}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 8289, forks 753 (observed 2026-08-28T04:10:20.092170+00:00)

## What it is
Sysdig is a Linux system exploration and troubleshooting tool that captures system calls and OS events at the kernel level, with native support for containers. It includes csysdig, a customizable curses-based UI, and can save trace files for later analysis, similar to tcpdump for system activity.

## Use cases
- troubleshoot what a process is doing on a Linux server
- inspect system calls inside Docker containers without instrumenting them
- capture system activity to a trace file and analyze it later
- replace strace, tcpdump, htop, and lsof with one consistent tool
- investigate container performance and network issues
- explore live system state with an interactive terminal UI

## When to choose
- you need deep syscall-level visibility on Linux, especially in containerized environments
- you want to record system activity for offline forensics or later analysis
- you prefer a single unified CLI over many disparate classic Linux tools

## When to avoid
- you need a commercial cloud security platform rather than an open-source troubleshooting tool
- you are on a non-Linux OS, since sysdig instruments the Linux kernel
- you only need lightweight metrics monitoring without kernel instrumentation

## Facets
- artifact type: cli-tool
- maturity: active
- function: monitoring, tracing, security, developer-tools
- domain: monitoring, security, operating-systems
- platform: cli
- tags: system-visibility, syscall-capture, container-troubleshooting, trace-files, curses-ui, containers, devops, linux, docker

## Member repositories
- draios/sysdig (main) score 78
- draios/sysdig-inspect (frontend) score 85

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:20.092170+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:28:05.928755+00:00, confidence not recorded.
  - readme: https://github.com/draios/sysdig (fetched 2026-08-28T04:10:20.092170+00:00, sha 5333a6d76d7c)
  - homepage: http://www.sysdig.com/ (fetched 2026-08-29T08:28:07.432648+00:00, sha 4463801a8562)
  - site_page: https://www.sysdig.com/about (fetched 2026-08-29T08:28:07.443462+00:00, sha 5fd493e5fe72)
  - site_page: https://docs.sysdig.com/en (fetched 2026-08-29T08:28:07.445939+00:00, sha a5cb5ba95bf0)
  - site_page: https://www.sysdig.com/integrations (fetched 2026-08-29T08:28:07.441601+00:00, sha 0d9e5465acde)
- Data as of 2026-08-30T08:39:29.467469+00:00.