March 2015 Summaries

Sysdig's Intelligent Alerting is designed to address the challenges of monitoring complex, distributed, and containerized environments by providing operations teams with a seamless way to manage alerts without additional configuration. Through features like self-learning baselines, group-based comparisons, and manual thresholding, the alerting system automatically detects anomalies and offers fine-grained customization options. Sysdig's unique workflow allows for easy alert creation from any view within the Sysdig UI, enabling a unified context that integrates monitoring and troubleshooting processes. This system provides a comprehensive view of infrastructure performance, allowing for rapid identification and resolution of issues, and aims to keep pace with the evolving landscape of operations engineering.

Sysdig 0.1.99 introduces enhancements and bug fixes to improve its functionality and reliability, including the ability to open multiple instances concurrently and more accurate filtering options. The release also addresses specific issues like sysdig crashes during socket scanning and enhances the default truncation algorithm. Additionally, Falco Feeds, an extension of Sysdig’s Falco, offers continuously updated, expert-written rules for threat detection, catering to open source-focused companies. Community support for Sysdig is available through a mailing list, and users can report bugs and issues via GitHub, with source code accessible for download in zip and tar.gz formats.

MongoDB, a popular NoSQL database, offers both map-reduce and the newer Aggregation framework for data processing tasks, with the latter being introduced in version 2.2 and promising faster performance. In an exploratory study, Sysdig Monitor was used to compare the performance of these two methods by analyzing MongoDB operations on a simulated dataset of three million customer entries. The study demonstrated that the Aggregation framework is approximately six times faster than map-reduce, using significantly less CPU during operation. Such testing highlights the importance of performance evaluation in making informed decisions about database operations, and the article encourages developers to consider the Aggregation framework to enhance efficiency in their MongoDB deployments.

Sysdig Cloud introduces a groundbreaking approach to container monitoring that provides deep visibility into container infrastructures without the need for internal instrumentation. Utilizing open-source sysdig technology, Sysdig Cloud allows users to monitor Docker, LXC, and libvirt-lxc containers by installing an agent on the host operating system or in a privileged container, thus enabling unified insight across distributed environments. This method circumvents the limitations of traditional monitoring techniques, which either rely on limited high-level metrics, application-specific data, or intrusive installation of agents within each container, all of which undermine the benefits of containerization. By leveraging the shared kernel architecture of containers and their host OS, Sysdig Cloud offers a comprehensive view of container activities and interactions, enabling users to analyze process execution, file system activity, network activity, and application metrics with ease. This system also provides real-time and historical data analysis capabilities, allowing organizations to troubleshoot performance issues and detect anomalies effectively.

Sysdig 0.1.98 introduces new features and updates, including enhanced container support for Docker, LXC, and libvirt-lxc, with the ability to access an alternate /proc file system tree and parse network connections from different namespaces. The release also includes automated Docker builds and scripts like sysdig-probe-loader for easier module loading in container environments, along with prebuilt sysdig-probe binaries for specific kernel configurations. New chisels have been added for monitoring containers, such as listing containers, tracking CPU usage, and observing network I/O, all with container-aware output. Additionally, updated filter fields and events improve reporting on control group and PID namespace information, with a detailed blog post promised soon for further insights.