$ show draios/sysdig
Sysdig is a mature, open-source system monitoring and troubleshooting CLI tool that instruments the Linux kernel to capture system calls and other OS events. It provides a rich curses-based interactive UI (csysdig) and an extensible Lua chisel framework for real-time analysis of CPU, I/O, network, security, and container metrics. The codebase is predominantly C++ with a Lua scripting layer, and includes a comprehensive plugin system for alternative event sources (e.g., gVisor, custom plugins). It also ships a large set of kernel driver build configurations (driverkit) for supporting many Linux distributions and kernel versions. The architecture is a classic CLI application with a modular design: libsinsp for event introspection, chisels for analysis, and a curses UI for visualization. The project is actively maintained by the Sysdig team and the Falco community, with regular commits and CI pipelines.
The LLM identified 3 files worth highlighting for reuse:
Manages discovery, loading, configuration, and initialization of both input source plugins and extraction plugins. It decouples the core capture engine from plugin-specific logic, providing a uniform interface that can be reused across different monitoring tools. The pattern is a clean plugin manager with lifecycle management, error handling, and configuration parsing.
Implements the core chisel framework that loads Lua scripts and binds them to the C++ event processing engine. It provides a well-defined API (on_init, on_event, on_capture_end, etc.) and handles field extraction, filtering, and callback dispatch. This pattern is a textbook example of embedding a scripting language into a high-performance C++ application, enabling extensible analysis without recompilation.
A pure Lua utility module providing reusable functions for formatting bytes, time intervals, sorting tables, and printing formatted output. It is independent of any specific chisel logic and can be dropped into any Lua-based analysis tool. Demonstrates good modularization of common helper functions in a scripting environment.