sysdig

Sysdig is both an open-source software project and a company that provides cloud-native visibility and security solutions. The open-source project, also called sysdig, emerged to give deep visibility into Linux systems by intercepting and analyzing system calls and other kernel events. It is widely used for debugging performance issues, investigating outages, and understanding containerized workloads on Linux, Docker, and Kubernetes.

The company Sysdig, founded in the 2010s, commercializes the technology and offers the Sysdig Platform, a unified platform for monitoring, troubleshooting, and security of cloud-native environments. The platform typically includes an agent deployed on hosts or within nodes to collect data from the operating system, containers, and orchestration layers, and a backend that ingests, normalizes, and visualizes the data. Customers use it to gain runtime visibility, alerting, and incident response for dynamic environments.

A key ecosystem component is Falco, an open-source runtime security project that originated with Sysdig and is now a Cloud Native Computing Foundation (CNCF) project. Falco analyzes system calls and other events in real time to detect suspicious behavior such as anomalous process activity, file access, or network connections.

Sysdig emphasizes security and compliance alongside observability, with use cases spanning incident investigation, performance troubleshooting, security monitoring, and policy-driven compliance checks for Kubernetes and cloud-native stacks. The open-source sysdig project remains freely available, while the company’s platform provides enterprise-grade features, integrations, and support.