March 2017 Summaries

Sysdig has developed a system to enhance monitoring within Kubernetes environments by introducing a feature called Teams, which allows for service-based access control, enabling developers to focus on analytics data relevant to their team while providing operators with multi-tenant monitoring capabilities. This system is further streamlined by Kubewatcher, a service that synchronizes Sysdig Teams settings with Kubernetes infrastructure details, using Kubernetes annotations for configuration. This integration allows for automated setup of monitoring environments, complete with dashboards and alerts, upon deployment of new microservices, thus simplifying operations for development and operations teams. By utilizing Kubewatcher, users can create isolated, dynamic monitoring environments and define alerts with configurable parameters, ensuring ready-to-use monitoring setups from the outset.

The blog post discusses the challenges and solutions involved in monitoring Docker and Kubernetes in a production environment, using the real-world example of WayBlazer, a cognitive recommendation engine in the travel industry. It highlights the importance of selecting the right metrics for monitoring and ensuring security through tools like Sysdig, which unifies infrastructure and service-centric views. WayBlazer operates on AWS, utilizing Kubernetes for its scalable architecture, and emphasizes monitoring application performance over solely infrastructure metrics. The post illustrates the impact of adopting Kubernetes on monitoring strategies, stressing the need for tools that understand Kubernetes constructs out-of-the-box and provide insights into both infrastructure and application layers. It recounts a specific incident of a "domino effect" failover in Kubernetes, leading to a robust improvement in their systems through detailed retrospectives and action plans.

The blog post, part of a series on operating Kubernetes in production, delves into troubleshooting service discovery within Kubernetes, using a real-world example involving a Kubernetes service with Nginx pods and a curl client. It highlights the challenges of troubleshooting in containerized environments, where traditional tools fall short due to container isolation and volatility. The post demonstrates the use of Sysdig, a Linux visibility tool, to capture and analyze system calls and metadata, revealing issues such as curl's misinterpretation of fully qualified domain names and the redundant appending of search domains, including "localdomain," which caused DNS resolution delays. The investigation traces the source of these issues to Kubernetes' interaction with Docker, ultimately attributing the inclusion of "localdomain" to Kubernetes' configuration. The post underscores the importance of Sysdig captures in reproducing and troubleshooting ephemeral container environments by providing comprehensive system-level insights.

Sysdig Cloud has been renamed Sysdig Monitor to better reflect the expanded capabilities and deployment options of the product, which now includes both cloud and on-premise software versions. The new name more accurately describes the product's core function of monitoring, although it doesn't encompass all features like troubleshooting, system captures, and alerting. The rebranding aligns with the company's strategy to introduce new products that can be offered as cloud or on-premise solutions, indicating upcoming innovations within the Sysdig family.

In a blog post by Knox Anderson, the process of detecting unauthorized SSH attempts using Sysdig is explored through a hands-on exercise designed to help users troubleshoot real-world issues. The scenario involves identifying the IP address and username of someone repeatedly attempting to SSH into a system, using Sysdig captures to analyze system calls at a specific time. The tutorial provides guidance on utilizing filters and chisels to inspect network activities, particularly focusing on port 22 where SSH connections occur, and emphasizes examining log file activities, such as those in the auth.log, to gather useful information. The exercise highlights the importance of understanding container behavior and network interactions, offering insights into troubleshooting and system monitoring beyond just identifying security breaches. The post encourages learning through practical examples and invites readers to explore more complex scenarios in future exercises.

CDK Global's Digital Marketing business unit adopted a containerized infrastructure to enhance their technology solutions for vehicle dealers worldwide, leading to challenges in monitoring Java applications within these containers. To address this, they turned to Sysdig, a tool that offers comprehensive monitoring capabilities by providing visibility into both the host and container levels, including Docker, JVM, JMX, and application metrics. This facilitated effective troubleshooting and improved productivity without requiring modifications to existing code or additional setup for collecting JMX metrics. Sysdig's intuitive features, such as its explore page and grouping capabilities based on metadata like data centers and applications, have been instrumental in optimizing system performance and supporting CDK's DevOps model. The Sysdig platform's ease of use and future-oriented features align with CDK's goals, making it a key component in their next-generation Platform as a Service (PaaS) development strategy.

Containers, particularly Docker, offer both security benefits and challenges in the software ecosystem. Key security features include the ability to verify container image integrity and authorship, ensuring that images have not been altered and originate from trusted sources. Docker supports this through image IDs and signing mechanisms. Container image scanning is crucial for detecting known vulnerabilities, though it requires maintainers to monitor and update dependencies regularly. Containers inherently reduce the attack surface by isolating applications, but tools like seccomp-bpf further restrict system calls to enhance security. Despite these measures, host-level security remains vital, as breaches can still occur. Traditional host-based intrusion detection systems (HIDS) face challenges in containerized environments due to their dynamic nature, but solutions like Sysdig Falco offer namespace-aware security monitoring that adapts to both containerized and host-level contexts.