December 2016 Summaries

Sysdig Tracers is a feature of the open-source Sysdig tool that enhances application monitoring by allowing users to track execution time of code segments without complex dependencies or significant overhead. It provides a way to tag code spans with minimal performance impact, making it accessible across various programming languages. An example API service using Python SimpleHTTPServer demonstrates how Sysdig Tracers can be applied to trace performance of HTTP GET requests by tagging different sections of code. The tool's capabilities extend beyond measuring API requests, offering insights into application, file, and network processing that contribute to latency. By using Sysdig Tracers, users can filter syscalls, conduct aggregations, and generate reports to identify and resolve performance bottlenecks within applications efficiently.

Kamol Mavlonov's blog post provides a step-by-step guide on setting up alerts for detecting failures in Mesos and Marathon applications using Sysdig. The process involves configuring alerts for both Marathon framework failures and Marathon app failures by navigating through the Sysdig interface and specifying certain criteria such as monitoring conditions, alert types, and notification channels. The guide highlights the need to adjust alert configurations when the IP addresses of master nodes change, ensuring that each master node is monitored effectively. Additionally, the post emphasizes the importance of customizing alerts with specific names, descriptions, and severities to enhance monitoring and response capabilities.

The transition to Docker and Kubernetes at Major League Soccer, as discussed by Brian Aznar, the director of engineering, was a strategic move to enhance infrastructure utilization and consistency across various systems, including a monolithic Drupal application. Initially faced with challenges such as configuring into AWS and managing complex networking, the transition ultimately resulted in increased efficiency and reliability, transforming what were once critical issues into manageable concerns. The adoption of Sysdig for monitoring provided granular insights into microservices, allowing for effective resource management and performance analysis. Aznar emphasizes the importance of understanding the objectives of adopting Docker and Kubernetes, balancing speed with reliability, and ensuring proper architecture for cloud environments to prevent potential issues. He advises newcomers to prioritize simplicity and visibility, acknowledging the initial complexity of integrating these technologies.

Sysdig Falco is a behavioral activity monitor that detects anomalous activities in applications by using policies that act on a stream of system calls from the kernel, differing from other security tools like SELinux, Seccomp, and AppArmor. These tools are categorized into enforcement and auditing groups, with enforcement tools such as Seccomp, Seccomp-bpf, SELinux, and AppArmor preventing system calls from succeeding, while auditing tools like Auditd and Falco monitor and notify when behavior deviates from policy. Seccomp provides basic sandboxing by restricting system calls, while its extension, seccomp-bpf, allows more flexible policy-based sandboxing. SELinux and AppArmor offer system-wide enforcement of policies, focusing on actors, actions, and targets, whereas Auditd monitors access and logs detailed actions. Falco, operating in user space, utilizes a kernel module for system call data, allowing it to leverage richer contextual information from sources like Kubernetes or Mesos, and despite being a "softer target" than kernel-level tools, offers a more straightforward policy language, enabling easier implementation of complex security policies.

Kubernetes simplifies container management by allowing the creation of container groups and defining services with virtual static IPs, enabling seamless access without needing to know individual container identities. This system functions like an intuitive load balancer and includes an internal DNS that resolves service names to IP addresses. The article explores the deployment of a simple service within Kubernetes and investigates the underlying processes using the Sysdig troubleshooting tool, which provides insights into system calls and interactions between containers, services, and the Kubernetes API. It highlights how Kubernetes uses SkyDNS to resolve DNS queries by querying etcd, a key-value store, and how iptables facilitate stateless load balancing by redirecting traffic to container IPs. This detailed examination of Kubernetes DNS and service functionalities illustrates the powerful orchestration and networking capabilities of Kubernetes, promising further exploration in subsequent discussions.