Sysdig captures system calls and other system level events using a linux kernel facility called tracepoints, which means much less overhead than strace. It then packetizes this information, so that you can save it into trace files and filter it, a bit like you would do with tcpdump. This makes it very flexible to explore what processes are doing. Sysdig is also packed with a set of scripts that make it easier to extract useful information and do troubleshooting. {

NOTE:} currently only the Linux version of sysdig is capable of capturing events and doing live analysis. On the other platforms, you will be limited to working with the trace files generated by a Linux installation of sysdig.

WWW: http://www.sysdig.org
