December 2014 Summaries

Sysdig 0.1.93 introduces several enhancements and bug fixes designed to improve functionality and security. A notable feature is the Falco Feeds, which enhances Falco by providing open-source companies with continuously updated, expert-written rules to guard against emerging threats. The update also includes the addition of the -E/--exclude-users command line flag to prevent importing user and group tables during capture initiation and limits buffer rendering on the screen to 80 bytes unless specified otherwise with the -v option. Furthermore, new and updated chisels and events have been incorporated, such as displaying the process name in the echo_fds header and returning thread exit codes with procexit. Community and technical support for Sysdig are available through the sysdig mailing list and GitHub for any bugs or issues.

System calls are a crucial interface between applications and the Linux operating system, enabling programs to request services from the kernel, such as file operations, process creation, and network communications. Understanding and tracing these calls provide valuable insights into program behavior and system performance, aiding in troubleshooting and monitoring. Tools like strace and sysdig allow users to observe system calls, with sysdig offering advanced filtering capabilities to make its extensive output manageable. Key system calls such as clone, execve, open, and connect are essential for monitoring process and network activity, while others like read/write and unlink/rename offer insights into file and memory management. The document encourages experimentation with system calls using sysdig and highlights the educational and practical benefits of mastering this aspect of Linux systems.

The first-ever sysdig meetup held at Jut HQ in San Francisco was deemed a success, with a strong turnout and enthusiastic participation from the sysdig community. The event featured presentations by sysdig founder and CEO Loris Degioanni, who discussed the development and architecture of sysdig, as well as other talks on comparing Apache and Nginx performance, analyzing a Linux server attack, and debugging pipe interactions using sysdig. Due to high interest, a second meetup is scheduled for February 11, 2015, with an open call for speakers and topics. For those unable to attend, the organizers plan to share updates and materials online to keep the global community engaged.