October 2016 Summaries

Sysdig, an open-source Linux system visibility tool, has achieved over one million downloads, marking a significant milestone in its development journey since its initial launch on April 3, 2014. Over the years, Sysdig has expanded its capabilities, including the addition of Docker visibility, the release of cSysdig for comprehensive stack monitoring, and the launch of Sysdig Cloud, the first container-native monitoring service. The company has also integrated with Kubernetes, introduced Sysdig Falco for behavioral security monitoring, and gained recognition as a noteworthy project on linux.com. As Sysdig continues to evolve and engage with its community, it has reached over 4,000 stars on GitHub and surpassed 200 customers for its cloud service. The announcement of these achievements coincided with Sysdig's first user conference in San Francisco, reflecting its ongoing commitment to innovation and community collaboration.

Falco 0.4.0 introduces significant enhancements, particularly in monitoring container and orchestration activities, with improved visibility into container information when matching events against Falco rules. Key features include new filterchecks like %container.privileged and %container.mount.*, which help detect events in privileged containers or those with specific mounts. The release also adds rules for detecting attempts to open files by processes in privileged containers or those with sensitive mounts, and incorporates Kubernetes and Marathon support to enrich event data with orchestration context. New tools like the event_generator Docker image allow users to test Falco's capabilities by simulating malicious activities. Additional features include a glob operator for pathname matching, a pmatch operator for testing path prefixes, verbose output enhancements, and the ability to write trace files. The update is accessible through rpm/debian packages, Docker Hub, and GitHub, with further details available on the Falco website.

Sysdig has introduced a new Python library, tracers-py, designed to simplify the process of emitting sysdig tracers, which are used to monitor and troubleshoot code performance by tracing events such as method calls and API requests. This open-source library provides a straightforward, Pythonic interface that allows developers to integrate tracers with minimal code, such as a single line within a context manager or a function decorator. By writing a string to /dev/null with a specific syntax, developers can trace system events across various programming languages, including bash and zsh. The library also supports advanced features like custom arguments, nested spans, and function argument tracing, making it versatile for different use cases. Sysdig also offers libraries for Node and Go, with contributions from TJ Holowaychuk, to further ease the process of incorporating tracers into codebases.

Sysdig's Fall 2016 release introduced several enhancements and new features aimed at improving service monitoring, container ecosystem support, and alerting capabilities. The update included new service views for easier troubleshooting, allowing users to quickly assess the health of services and visualize performance metrics, alongside enhanced Kubernetes support, including additional metadata and improved monitoring installation. Google Container Engine integration was simplified, and Sysdig became available in the DC/OS Universe. Alerting improvements featured a native integration with VictorOps, multi-channel alerting across various platforms, and the introduction of SysdigBot for Slack, which facilitates interaction with the monitoring system. Additionally, Sysdig introduced Tracers for transaction tracing and a new version of Sysdig Falco with improved performance, culminating in the announcement of their first community conference focused on container troubleshooting and Linux performance.

Sysdig has enhanced its Docker monitoring capabilities by introducing a range of new alerting features designed to improve user workflows. These updates include multi-condition alerting, which allows users to set advanced alerts based on custom Boolean expressions, and Slack Alert Notifications, enabling seamless monitoring within Slack. Additionally, the platform now supports Alert Resolved notifications, which inform users when issues are resolved, and integrates with VictorOps and OpsGenie for streamlined alert management. Sysdig also offers WebHook output for automated responses to alerts, and plans to further develop its alerting features by introducing an easier workflow and the ability to alert on events as well as metrics in the future.

In a detailed exploration of server monitoring for Tor exit nodes, Kenan Sulayman shares insights into managing high-throughput environments using Sysdig's monitoring tools. The Tor network, initially developed by the U.S. Navy, facilitates anonymous internet browsing by encrypting and routing traffic through different servers. Sulayman operates Tor servers co-located in data centers across Europe and highlights the importance of monitoring server performance, network visibility, and application optimization. He praises Sysdig for its comprehensive monitoring capabilities, which include server health, application performance, and network traffic analysis, allowing him to handle significant traffic loads efficiently. Additionally, Sulayman uses Sysdig's open-source tool, Falco, for security monitoring to detect potential breaches, enhancing his system's security posture. He appreciates the time saved in debugging and the cost-effectiveness of consolidating his monitoring tools into Sysdig, enabling him to focus on higher-level maintenance and development projects.