Alternatives to sysdig
A Linux command-line tool for exploring and troubleshooting systems by capturing system calls, with container support. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
sysdig
A Linux command-line tool for exploring and troubleshooting systems by capturing system calls, with container support.
Replacements
Listings that take over the same core job as sysdig.
bpftrace
A high-level tracing language and command-line tool for observing the Linux kernel and processes with eBPF.
bpftrace uses eBPF with a one-line scripting language and ready-made tools for kernel and process tracing, but is not container-aware out of the box.
Inspektor Gadget
eBPF-based tools for inspecting and debugging Kubernetes clusters and Linux hosts.
Inspektor Gadget offers ready-made eBPF gadgets with container and Kubernetes-aware output, aimed at cluster operators debugging workloads at kernel level.
Tracee
A Linux runtime security and forensics tool that traces system events using eBPF.
Tracee traces system events with eBPF and adds built-in security detectors, suiting runtime security and forensics more than general troubleshooting.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Tetragon provides eBPF security observability with real-time runtime enforcement and Kubernetes metadata, aimed mainly at Kubernetes environments.
Similar software
Related functionality, not a direct replacement.
Process Monitor
Logs every file, registry, process, thread and DLL operation on Windows in real time, which is how you find out why something failed.
Sysmon
A Sysinternals service that logs detailed process, network and file activity to the Windows event log.
Hubble
A network, service and security observability tool for Kubernetes clusters running Cilium, built on eBPF.
atop
A full-screen Linux performance monitor that reports and logs system and per-process resource usage.
below
A Linux resource monitor that records system, cgroup and process statistics and replays them later.
osquery
Query operating-system information using SQL.
