Sysdig is an open-source tool that captures and analyzes system-level data. It is widely used for troubleshooting, performance monitoring, and security analysis. In this tutorial, we’ll guide you through the installation and basic usage of Sysdig on Ubuntu 24.04. Additionally, we’ll explore multiple Sysdig commands for monitoring different aspects of system performance.

Why Use Sysdig?

Sysdig is particularly useful for:

• Performance Monitoring: Sysdig helps track resource usage such as CPU, memory, network, and disk I/O, making it ideal for performance tuning and identifying bottlenecks.
• Troubleshooting: By analyzing real-time system calls and activities, Sysdig assists in diagnosing issues with processes, containers, or the operating system itself.
• Security: Sysdig can be used to monitor security events by tracking suspicious system behaviors, such as unauthorized file access or unusual network activity.
• Container Monitoring: It has built-in support for Docker and Kubernetes environments, allowing you to monitor and troubleshoot containerized applications easily.

Key Features:

• Real-time System Monitoring: Captures and visualizes live system metrics.
• Deep Container Visibility: Provides in-depth monitoring for containerized applications.
• Flexible Filters: You can filter and search data by process, network connection, or system event.
• Scalable for Large Systems: Sysdig is designed to scale with large infrastructures, making it suitable for complex cloud environments.

Prerequisites

• A running instance of Ubuntu 24.04.
• Root or sudo access to install packages.

---

Creating an Instance on Cloud.shape.host

To set up a cloud instance on Cloud.shape.host and use Sysdig for system monitoring, follow these steps:

Step 1: Access the Dashboard and Create

1. Log in to your Cloud.shape.host account.
2. Click Create and select Instances.

Step 2: Choose a Datacenter Location

Choose the datacenter location that best fits your needs (e.g., New York, London, or Frankfurt).

Step 3: Select a Plan

Pick a plan based on your resource needs, such as Standard, CPU-Optimized, or Memory-Optimized.

Step 4: Choose an Operating System

Select your preferred OS, such as Ubuntu, CentOS, or Windows.

Step 5: Configure and Launch

Configure the network type (Basic or Advanced) and authentication method (SSH key or password). Name your instance and click Create Instance.

Locate Your Instance’s IP Address

Step 6: Accessing Your Instance

• For Linux-based OS: Use SSH to access the instance:

  ssh root@<your-instance-ip>

Replace <your-instance-ip> with the actual IP address.

• For Windows-based OS: Use a Remote Desktop client, entering the public IP address of the instance to connect.

Make sure to use the credentials or SSH key configured during setup.

---

Step-by-Step Installation of Sysdig

1. Update and upgrade the system:
   Begin by updating your system’s package list and upgrading any outdated packages:

   apt update -y
   apt upgrade -y

2. Install required dependencies:
   To ensure the Sysdig installation script works properly, install gnupg, software-properties-common, and curl:

   apt install gnupg software-properties-common curl -y

3. Install Sysdig:
   Use the official Sysdig installation script to download and install the tool. This script adds the appropriate repositories and installs Sysdig:

   curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | bash

4. Check Sysdig version:
   Verify the installation by checking the Sysdig version:

   sysdig --version

5. Launch csysdig (a command-line interface for Sysdig):
   csysdig is a more interactive and real-time view for monitoring system load. Launch it using the following command:

   csysdig

Using Sysdig: Common Commands and Examples

After installation, you can start using Sysdig to monitor various aspects of your system. Here are a few common commands with explanations:

1. Monitor network connections:

You can use Sysdig to view real-time network connections, including IP addresses and open ports, using the netstat filter:

   sysdig -c netstat

This command displays the network connections in a format similar to netstat, showing source/destination IPs, ports, and states.

2. Monitor top CPU-consuming processes:

To view the processes that are consuming the most CPU resources on your system, use the topprocs_cpu filter:

   sysdig -c topprocs_cpu

This will list the top processes ranked by CPU usage, helping you identify resource-hungry processes.

3. List available Sysdig filters:

Sysdig provides many pre-built filters to help monitor various aspects of the system. To list all available filters, use:

   sysdig -cl

Some other useful filters include:

• topfiles_bytes: Shows the top files in terms of I/O traffic.
• topprocs_net: Shows the top processes using the network.
• fdlist: Lists all file descriptors in use by processes.

4. Capture and analyze system calls:

Sysdig can capture low-level system calls made by processes. Use this to troubleshoot performance issues or inspect suspicious behavior:

   sysdig -w capture_file.scap

This command captures all system activity into a .scap file for later analysis. You can analyze the file with:

   sysdig -r capture_file.scap

5. Filter output by specific processes:

To monitor specific processes or programs, use the proc.name filter. For example, if you want to monitor all system calls from the nginx service:

   sysdig proc.name=nginx

6. Monitor Disk I/O:

Sysdig can also help you monitor disk usage. The iobytes filter shows the I/O usage for processes:

   sysdig -c iobytes

This provides a view of which processes are reading/writing the most data to the disk.

7. Monitor HTTP requests:

Sysdig can also be used to analyze HTTP requests being processed on the system:

   sysdig -c httplog

This command gives you a real-time view of HTTP traffic, showing the requests being made and their response statuses.

---

For reliable cloud infrastructure and VPS hosting solutions, consider Shape.host. They offer high-performance Cloud VPS services, which are perfect for deploying tools like Sysdig for efficient system monitoring. Their services are scalable, providing an excellent foundation for managing modern server workloads and performance monitoring tools.