# Install sysdig with Homebrew, MacPorts, Nix, pacman, apt, zypper
System-level exploration and troubleshooting tool. Version 0.41.4 via Homebrew; verified 2026-08-02. Also installable with nix: nix profile install nixpkgs#sysdig.
## Install
```sh
sudo av install brew:sysdig
```
Additional install commands:
### macOS
- Homebrew (100%):
```sh
brew install sysdig
```
Evidence: local Homebrew formula metadata
- MacPorts (94%):
```sh
sudo port install sysdig
```
Evidence: MacPorts ports tree: sysutils/sysdig/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
### Linux
- Nix (92%):
```sh
nix profile install nixpkgs#sysdig
```
Evidence: nixpkgs package indexes: sysdig from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix
- pacman (92%):
```sh
sudo pacman -S sysdig
```
Evidence: Arch Linux sync databases: sysdig from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
- Ubuntu apt (92%):
```sh
sudo apt install sysdig
```
Evidence: Ubuntu 24.04 LTS package indexes: sysdig from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
- zypper (92%):
```sh
sudo zypper install sysdig
```
Evidence: openSUSE Tumbleweed package metadata: sysdig from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst
## Package facts
- **Package key:** brew:sysdig
- **Package manager:** Homebrew
- **Version:** 0.41.4
- **Source summary:** System-level exploration and troubleshooting tool
- **Homepage:**
- **Repository:**
- **Last updated:** 2026-08-02T22:39:34+09:00
- **Generated:** 2026-08-03T19:37:03+00:00
## Executables
- csysdig (alias)
- scap-driver-loader (alias)
- sysdig (alias)
## Install behavior
- Bottle: not available
## Freshness
- Page generated: 2026-08-03
- Package-manager version: 0.41.4
## Project history and usage
sysdig is a system-visibility and troubleshooting CLI that became important to package and operations culture by bringing packet-capture-style workflows to system calls, processes, files, networking, and containers.
### Project history
Sysdig's official announcement introduced it as an open-source system exploration tool focused on system-level monitoring and troubleshooting. The announcement connected the project to the founders' earlier work on Wireshark and WinPcap and described sysdig as an evolution from network packets toward host and process activity.
The GitHub README presents sysdig as a universal system visibility tool with native container support and describes `csysdig` as a curses UI for the same data. It emphasizes kernel-level capture of system calls and OS events, trace files, and later analysis in a way analogous to tcpdump and Wireshark for networks.
Sysdig's company history says Loris Degioanni founded Sysdig in 2013 and that sysdig OSS was created in 2014 as the first tool for deep, system-call-level introspection into containers.
### Adoption history
The README documents container-based usage through the official Docker image and distribution-specific deb/rpm release packages. The input package facts list Homebrew, MacPorts, Nix, Arch, Ubuntu, and zypper packages, showing the tool's spread across both macOS package-manager and Linux distribution channels.
Sysdig later became part of a broader open-source security family. A Sysdig Open Source Community announcement groups sysdig OSS with Wireshark, Falco, and Stratoshark, and describes sysdig OSS as the foundation of open-source system visibility for cloud-native forensics and incident response.
### How it is used
sysdig is used from the shell to inspect live system activity or capture trace files for later troubleshooting. The README summarizes its pitch as combining ideas from tools such as strace, tcpdump, htop, iftop, and lsof.
The `csysdig` executable gives a terminal UI for interactive exploration, while the `sysdig` CLI remains the package-manager-visible entry point for scripts, incident response, and low-level inspection.
### Why package nerds care
sysdig matters to package nerds because it sits at the boundary between ordinary userland packages and kernel-facing observability: packaging has to account for drivers, containers, distribution releases, and security expectations.
It also helped make container-aware troubleshooting a packageable CLI experience, not just a hosted monitoring product.
### Timeline
- 2013: Loris Degioanni founded Sysdig.
- 2014: sysdig OSS was created for system-call-level introspection into containers.
- 2014: Sysdig was publicly announced as an open-source system exploration tool.
- 2016: Sysdig created Falco, a related runtime security project.
- 2025: Sysdig announced an Open Source Community grouping sysdig OSS with Wireshark, Falco, and Stratoshark.
### Related projects
- csysdig is the curses-based terminal UI shipped with sysdig.
- Falco grew from the same open-source security lineage and uses runtime/event ideas adjacent to sysdig.
- Wireshark and tcpdump are recurring reference points in official sysdig materials because sysdig adapts packet-capture-style analysis to host and container activity.
### Sources
-
-
-
-
- input source_facts.package-manager
## Security Notes
narrow executable package without higher-risk signals.
- **Geiger risk:** green / low
- narrow executable package without higher-risk signals
## Other Package-Manager Records
- Nix - sysdig: normalized package name match | nixpkgs package indexes: sysdig from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix
- Ubuntu apt - sysdig - 0.36.0+repack-1: normalized package name match | Ubuntu 24.04 LTS package indexes: sysdig from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | system-level exploration and troubleshooting tool | https://www.sysdig.com/
- pacman - sysdig - 0.41.4-2: normalized package name match | Arch Linux sync databases: sysdig from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Open source system-level exploration and troubleshooting tool | https://www.sysdig.com/
- zypper - sysdig - 0.41.4-1.4: normalized package name match | openSUSE Tumbleweed package metadata: sysdig from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | System-level exploration | https://github.com/draios/sysdig
- zypper - sysdig-bash-completion - 0.41.4-1.4: normalized package name match | openSUSE Tumbleweed package metadata: sysdig-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Bash completion for sysdig | https://github.com/draios/sysdig
- zypper - sysdig-zsh-completion - 0.41.4-1.4: normalized package name match | openSUSE Tumbleweed package metadata: sysdig-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Zsh completion for sysdig | https://github.com/draios/sysdig
- MacPorts - sysdig: normalized package name match | MacPorts ports tree: sysutils/sysdig/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
## Combined YAML source
View the package source record on GitHub. [combined/sysdig.yml](https://github.com/mxcl/pkgdb/blob/main/combined/sysdig.yml)
## Sources
- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph