Install sysdig with Homebrew, MacPorts, Nix, pacman, apt, zypper

Project links

• Homepage
• Repository

Commands and aliases

• csysdig
• scap-driver-loader
• sysdig

Project history

Sysdig's official announcement introduced it as an open-source system exploration tool focused on system-level monitoring and troubleshooting. The announcement connected the project to the founders' earlier work on Wireshark and WinPcap and described sysdig as an evolution from network packets toward host and process activity.

The GitHub README presents sysdig as a universal system visibility tool with native container support and describes `csysdig` as a curses UI for the same data. It emphasizes kernel-level capture of system calls and OS events, trace files, and later analysis in a way analogous to tcpdump and Wireshark for networks.

Sysdig's company history says Loris Degioanni founded Sysdig in 2013 and that sysdig OSS was created in 2014 as the first tool for deep, system-call-level introspection into containers.

Adoption history

The README documents container-based usage through the official Docker image and distribution-specific deb/rpm release packages. The input package facts list Homebrew, MacPorts, Nix, Arch, Ubuntu, and zypper packages, showing the tool's spread across both macOS package-manager and Linux distribution channels.

Sysdig later became part of a broader open-source security family. A Sysdig Open Source Community announcement groups sysdig OSS with Wireshark, Falco, and Stratoshark, and describes sysdig OSS as the foundation of open-source system visibility for cloud-native forensics and incident response.

How it is used

sysdig is used from the shell to inspect live system activity or capture trace files for later troubleshooting. The README summarizes its pitch as combining ideas from tools such as strace, tcpdump, htop, iftop, and lsof.

The `csysdig` executable gives a terminal UI for interactive exploration, while the `sysdig` CLI remains the package-manager-visible entry point for scripts, incident response, and low-level inspection.

Why package nerds care

sysdig matters to package nerds because it sits at the boundary between ordinary userland packages and kernel-facing observability: packaging has to account for drivers, containers, distribution releases, and security expectations.

It also helped make container-aware troubleshooting a packageable CLI experience, not just a hosted monitoring product.

Timeline

• 2013: Loris Degioanni founded Sysdig.
• 2014: sysdig OSS was created for system-call-level introspection into containers.
• 2014: Sysdig was publicly announced as an open-source system exploration tool.
• 2016: Sysdig created Falco, a related runtime security project.
• 2025: Sysdig announced an Open Source Community grouping sysdig OSS with Wireshark, Falco, and Stratoshark.

Related projects

• csysdig is the curses-based terminal UI shipped with sysdig.
• Falco grew from the same open-source security lineage and uses runtime/event ideas adjacent to sysdig.
• Wireshark and tcpdump are recurring reference points in official sysdig materials because sysdig adapts packet-capture-style analysis to host and container activity.

Sources

• https://github.com/draios/sysdig#readme
• https://www.sysdig.com/about
• https://www.sysdig.com/blog/announcing-sysdig
• https://www.sysdig.com/press-releases/sysdig-launches-open-source-community
• input source_facts.package-manager