Extending Sysdig with Chisel
•
0 likes•947 views
Sysdig is infinitely extensible through Chisels, and now you’re going to learn how to build one. Using a real-world example, we’re going to show you how to leverage sysdig’s luascript engine to build powerful new functionality customized to your needs.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Extending Sysdig with Chisel
Similar to Extending Sysdig with Chisel (20)
More from Sysdig
Recently uploaded
Recently uploaded (20)
Extending Sysdig with Chisel
- 1. Extending Sysdig Gianluca Borello, Engineering Manager
- 2. Information presented is confidential Sysdig modular architecture
- 3. Information presented is confidential Command line
- 4. Information presented is confidential Command line Sysdig embraces the UNIX philosophy, with a very powerful textual output that can be piped into other tools for further processing: • Standard command line output • • Custom output format
- 5. Information presented is confidential Command line • json output • Various data buffer encodings
- 6. Information presented is confidential Chisels
- 7. Information presented is confidential Chisels • A chisel is a Lua script that is automatically called from sysdig, and receives all the system events with all their precious state attached • Rich bidirectional API with the sysdig engine (documented at github.com/draios/sysdig/wiki/Sysdig-Chisel-API-Reference-Manual) • Very good performance thanks to embedded LuaJIT engine • Trivial to extend sysdig: creating a chisel is as simple as dropping a script under ~/.chisels • Endless possibilities via third-party Lua libraries
- 8. Information presented is confidential Chisels
- 9. Information presented is confidential Chisels Initialization boilerplate.
- 10. Information presented is confidential Chisels Callbacks called automatically by the engine.
- 11. Information presented is confidential Chisels The chisel contacts the engine requesting specific fields for the events.
- 12. Information presented is confidential Chisels Called at every system event. This is where the magic happens.
- 13. Information presented is confidential Advanced extensions
- 14. Information presented is confidential libsinsp
- 15. Information presented is confidential libsinsp • Event-based C++ API • Supports state • Supports filters • Understands files/network connections/threads/processes • Understands containers and their metadata • Understands cluster orchestrators (Kubernetes, Mesos…) • Fully independent shared library that can be used stand-alone • Ideal for building advanced stateful applications (but you should look into chisels first)
- 16. Information presented is confidential libsinsp
- 17. Information presented is confidential libscap
- 18. Information presented is confidential libscap • Lower level event-based C API (simil libpcap) • Mostly stateless • Extracts system events from the kernel as fast as possible • Helpers for gathering information from /proc • Fully independent shared library that can be used stand-alone • Building block for high-performance system event analyzers • Use case: high speed correlation between network packets and processes: ntop.org/pf_ring/using-sysdig-from-pf_ring-and-soon-from-all-ntop-apps
- 19. Information presented is confidential libscap
- 21. Information presented is confidential Use case https://groups.google.com/forum/#!topic/sysdig/Vl_pbNR749I
- 22. Information presented is confidential The scavenger chisel
- 23. Thank You!