The Dark Art of Container Monitoring
summary
Sysdig builds a host-side kernel module that captures every syscall, network packet and file I/O and decodes protocols so containers are inspected from outside without injecting agents. Live demos show decoded MySQL queries, per-container spectrogram latency heatmaps, Kubernetes API enrichment to group pods and services, and a tracer demo with tracer markers showing aggregate 34ms vs mapreduce 2055ms to prove an optimization. The system runs in production, supports Docker and Rocket, and exports traces for central analysis.
AI-written summary · about
chapters (22)
- 0:00Intro
- 1:16What are containers
- 2:03Container Monitoring
- 2:51Monitoring is not all of it
- 3:32Context
- 5:27Containers
- 9:19Production Ready
- 10:08Architecture
- 11:38Real Operating System
- 16:03Processes View
- 18:08System Calls View
- 20:08HTTP Traffic View
- 21:08WordPress Connection
- 21:43Errors
- 22:33Open Calls
- 23:08Spectrogram
- 26:13Presentation
- 28:08Demo
- 33:18Topology Map
- 35:18Dev Null
- 37:18Example
- 40:33Questions
related talks
37mYou’re Monitoring Kubernetes Wrong
28mYou’re monitoring containers wrong
29mKubernetes-Defined Monitoring [I]
36m50 Shades of System Calls
31mFrom Kernel To Cloud: Building a Complete Open Source Observ...
33mOpenTracing and Containers: Depth, Breadth, and the Future of Tracing
30mMix Kubernetes with Linux Kernel Tracing to Boost the Observability of Your Cluster- 30mMix Kubernetes with Linux Kernel Tracing to Boost the Observability of Your Cluster