Intro to sysdig in 15 minutes
•
0 gostou•746 visualizações
Well, the title says it all. Get ready to be really productive, really fast.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Destaque
Destaque (14)
Semelhante a Intro to sysdig in 15 minutes
Semelhante a Intro to sysdig in 15 minutes (20)
Mais de Sysdig
Mais de Sysdig (8)
Último
Último (20)
Intro to sysdig in 15 minutes
- 1. Luca Marturana, Software engineer Sysdig in 15 minutes
- 2. Information presented is confidential Containers • Easy to bundle apps • Easy to replicate environments • Bridge from app developers to ops engineers
- 3. Information presented is confidential Containers in production: new challenges • Orchestration • Monitoring • Troubleshooting • Logging • Security
- 4. Information presented is confidential Troubleshooting • network: tcpdump, netstat • file: lsof • memory/cpu: top, ps They don’t play well with containers
- 5. Information presented is confidential Sysdig architecture Kernel Container1 Docker Container2 runc Container3 rkt sysdig Docker Capture and analysis Instrumentation through kernel module
- 6. Information presented is confidential sysdig • Capture system events, filter them, run useful scripts • Tracefiles for postponed analysis • Native support for: Docker, Kubernetes, Mesos, rkt and so on • Open Source
- 7. Information presented is confidential Two Flavours • event filtering and printing on screen • apply bundled or custom chisels • save tracefiles for later analysis • easy to use interface • tabular or graphic views for various purposes sysdig csysdig
- 8. Demo
- 9. Hands on!
- 10. Information presented is confidential Setup Install sysdig: https://www.sysdig.org/install/ Download captures: http://go.sysdig.com/ccwfs-captures
- 11. Information presented is confidential Exercise 1 Somebody is trying to log into our machine, find his IP! Capture: trace01.scap
- 12. Information presented is confidential Solution 1 sysdig -r trace01.scap -c topconns fd.port = 22 sysdig -r trace01.scap -c spy_syslog proc.name = sshd
- 13. Information presented is confidential Exercise 2 Find the failing HTTP requests What’s wrong in them? Capture: trace02.scap
- 14. Information presented is confidential Solution 2 sysdig -r trace02.scap -c httplog|grep code=5 csysdig -r trace02.scap Containers -> nginx -> Connections
- 15. Information presented is confidential Exercise 3 Capture: trace03.scap Weird syscall behaviour Hint: look csysdig Errors view
- 16. Information presented is confidential Solution 3 sysdig -r trace03.scap -c topscalls sysdig -r trace03.scap -c echo_fds proc.name python and fd.name contains myscript.py sysdig -r trace03.scap proc.name = python and evt.type = close
- 17. Thank You!