50 Shades of System Calls
summary
Builds a Sysdig-based tracer that traces everything at syscall level by inserting entry/exit markers into the kernel event stream and collecting spans in user space, using a tiny kernel module plus Lua “chisels” and language wrappers for Python/Go with decorators and context managers. Demonstrates measuring latency per span, drilling to per-call syscalls, exporting metrics to StatsD/Prometheus, and live debugging in containers. Works on one host with very low kernel overhead but captures can grow to hundreds of MBs or GBs, complicating analysis.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:23Tracing
- 9:05Example
- 11:30Python Example
- 15:00Python Server
- 17:30Tracers
- 18:20CommonLine
- 19:00System
- 20:50Network
- 22:30Aggregate
- 23:00Stop
- 23:30Matrix
- 24:30Delete
- 29:30Filter
- 31:00Crosshost tracing
- 32:30Attacks
- 34:10Root permissions
related talks
44mThe Dark Art of Container Monitoring
43mBring the Power of Wireshark To Syscalls and Logs With Stratoshark
37mKernel and userspace tracing with LTTng and friends
41mLinux Tracing Techniques
30mMix Kubernetes with Linux Kernel Tracing to Boost the Observability of Your Cluster
41mAnalyzing Your System with Tracing Libraries- 30mMix Kubernetes with Linux Kernel Tracing to Boost the Observability of Your Cluster
31mFantastic tracepoints and where to find them