Sysdig is open source, system-level exploration: capture system state and activity from a running Linux-based system such as Debian, then save, filter, and analyze that is particularly useful for system analysis, inspection, and debugging, amongst other uses. Sysdig is scriptable in Lua and includes a command-line interface and a powerful interactive UI using the command csysdig that runs in your terminal.
In the following tutorial, you will learn how to install Sysdig on Debian 11 Bullseye.
Table of Contents
- Recommended OS: Debian 11 Bullseye
- User account: A user account with sudo privilages or root access (su command).
- Required Packages: curl
Updating Operating System
Update your Debian 11 operating system to make sure all existing packages are up to date:
sudo apt update && sudo apt upgrade
Root or Sudo Access
By default, when you create your account at startup with Debian compared to other distributions, it does not automatically receive sudoers status. You must either have access to the root password to use the su command or visit our tutorial on How to Add a User to Sudoers on Debian.
Install CURL Package
The tutorial will utilize the curl package; first, verify if the package is present:
Example output if installed:
curl 7.74.0 (x86_64-pc-linux-gnu) libcurl/7.74.0 OpenSSL/1.1.1k zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) libssh2/1.9.0 nghttp2/1.43.0 librtmp/2.3 Release-Date: 2020-12-09
If you do not have curl installed, use the following command:
sudo apt install curl -y
To install Sysdig on Debian 11 is not a hard process. You first need to use the curl command to download and then execute the bash file. This is done by using the following terminal command:
sudo curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash
The overall process should not take longer than a few minutes at most.
Once installed, confirm the version and build of Sysdig by using the following:
You should get the following output:
sysdig version 0.27.1
How to use Sysdig
Now that you have installed Sysdig, you can use the monitoring software, which will be done with the csysdig command. A word of note, you need to run sysdig as root because it requires access to critical areas such as /proc file system, /dev/sysdig* devices, and needs to auto-load the sysdig-probe kernel module.
First, bring up the display using the following command:
You will see the following screen below:
Note, if you have trouble opening Sysdig, check the troubleshooting at the bottom of the tutorial.
Next, you can press the F2 button to change the view back for future reference.
In the menu view above, you can use your arrow keys to move around to select an option you would like to monitor. For example, you want to see the Processes CPU, then scroll down and hit the ENTER key, which will then display the following:
To return to the previous menu selection, use the F2 button key. From here, you can select quite an extensive list. Alternatively, you can use the terminal line commands. Some examples of these commands are shown below:
Run the following command to see the top processes ranked by CPU utilization percentage:
sudo sysdig -c topprocs_cpu
Run the following command to see the system’s network connections:
sudo sysdig -c netstat
To see a list of system processes:
sudo sysdig -c ps
If you encounter the following problem when trying to use the csysdig for the first time (Error opening terminal: xterm-256color). This can be solved most times by installing the following package:
sudo apt install ncurses-term
Note, only install (ncurses-term) if you see the error message.
Comments and Conclusion
You have learned how to install Sysdig on Debian 11 by learning basic navigating and terminal commands in the tutorials. Overall, Sysdig combined the functionality of many existing command-line tools and combined them into one application with an excellent GUI or using traditional terminal commands to monitor nearly any part of your Linux system.