Capture system calls and OS events with kernel-level instrumentation. Analyze container activity, network traffic, and process behavior in real-time using an intuitive ncurses interface.

Csysdig provides a visual, interactive way to explore your Linux system and containers at the kernel level. It captures system calls and OS events, giving you unprecedented visibility into what's happening on your machines without requiring any instrumentation of containers themselves.

Key capabilities include:

Kernel-level instrumentation - Captures system calls and OS events directly from the Linux kernel
Container-native - Inspect containerized applications without modifying container images or adding agents
Trace file analysis - Record system activity for later investigation, similar to tcpdump for networks
Unified interface - Replaces multiple fragmented tools (strace, tcpdump, htop, lsof) with one consistent experience
Real-time monitoring - View live system activity with full context and rich state information
Customizable UI - Fully configurable curses-based interface for different troubleshooting scenarios

The tool is particularly valuable for debugging production issues, understanding container behavior, and analyzing system performance without the complexity of traditional Linux utilities. Whether you're investigating network connections, process activity, file access, or system calls, csysdig presents the data in an intuitive, navigable format that makes deep system exploration accessible to operators and developers alike.