三、使用sysdig
在成功安装sysdig之后，我们要列举几个最受欢迎的例子。使用sysdig最简单也是最容易的方案就是直接调用sysdig，无需任何其他。如下：
# sysdig
在默认情况下，sysdig将会捕捉到编号、 时间、CPU数量、PID、类型和详细参数等。
大量的输出可能会让人烦躁，而且并非所有信息都会有用，所以你可以通过-w来保存需要的信息。
# sysdig -w result.dump
运行-r来调出你已经保存过的文件。sysdig 命令也可以用 CTRL+C 来停止。
# sysdig -r result.dump
sisdig过滤器
归于你需要的特定信息，你需要使用sisdig过滤器，用下面的命令找到需要过滤出来的信息列表。
# sysdig -l
----------------------
Field Class: fd
fd.num the unique number identifying the file descriptor.
fd.cport for TCP/UDP FDs, the client port.
fd.rproto for TCP/UDP FDs, the remote protocol.
----------------------
Field Class: process
proc.pid the id of the process generating the event.
proc.name the name (excluding the path) of the executable generating the
event.
proc.args the arguments passed on the command line when starting the proc
ess generating the event.
proc.env the environment variables of the process generating the event.
proc.cmdline full process command line, i.e. proc.name + proc.args.
proc.exeline full process command line, with exe as first argument, i.e. pro
c.exe + proc.args.
proc.cwd the current working directory of the event.
proc.duration number of nanoseconds since the process started.
proc.fdlimit maximum number of FDs the process can open.
proc.fdusage the ratio between open FDs and maximum available FDs for the pr
ocess.
.
thread.pfminor number of minor page faults since thread start.
thread.ismain 'true' if the thread generating the event is the main one in th
e process.
所以，你可以利用sisdig过滤器来对庞大的信息量进行过滤，获得自己需要的内容。这里举一个“MySQLD”的例子。
# sysdig -r result.dump proc.name=mysqld
140630 02:20:30.848284977 2 mysqld (2899) io_getevents
140632 02:20:30.848289674 2 mysqld (2899) > switch next=2894(mysqld) pgft_maj=0 pgft_min=1 vm_size=841372 vm_rss=85900 vm_swap=0
140633 02:20:30.848292784 2 mysqld (2894) io_getevents
140635 02:20:30.848297142 2 mysqld (2894) > switch next=2901(mysqld) pgft_maj=0 pgft_min=4 vm_size=841372 vm_rss=85900 vm_swap=0
140636 02:20:30.848300414 2 mysqld (2901) io_getevents
140638 02:20:30.848307954 2 mysqld (2901) > switch next=0 pgft_maj=0 pgft_min=1 vm_size=841372 vm_rss=85900 vm_swap=0
140640 02:20:30.849340499 1 mysqld (2900) io_getevents
140642 02:20:30.849348907 1 mysqld (2900) > switch next=2895(mysqld) pgft_maj=0 pgft_min=1 vm_size=841372 vm_rss=85900 vm_swap=0
140643 02:20:30.849357633 1 mysqld (2895) io_getevents
140645 02:20:30.849362258 1 mysqld (2895) > switch next=26329(tuned) pgft_maj=0 pgft_min=1 vm_size=841372 vm_rss=85900 vm_swap=0
140702 02:20:30.995763869 1 mysqld (2898) io_getevents
140704 02:20:30.995777232 1 mysqld (2898) > switch next=2893(mysqld) pgft_maj=0 pgft_min=1 vm_size=841372 vm_rss=85900 vm_swap=0
140705 02:20:30.995782563 1 mysqld (2893) io_getevents
140707 02:20:30.995795720 1 mysqld (2893) > switch next=0 pgft_maj=0 pgft_min=3 vm_size=841372 vm_rss=85900 vm_swap=0
140840 02:20:31.204456822 1 mysqld (2933) futex addr=7F1453334D50 op=129(FUTEX_PRIVATE_FLAG|FUTEX_WAKE) val=1
140842 02:20:31.204464336 1 mysqld (2933) futex addr=7F1453334D8C op=393(FUTEX_CLOCK_REALTIME|FUTEX_PRIVATE_FLAG|FUTEX_WAIT_BITSET) val=12395
140844 02:20:31.204569972 1 mysqld (2933) > switch next=3920 pgft_maj=0 pgft_min=1 vm_size=841372 vm_rss=85900 vm_swap=0
140875 02:20:31.348405663 2 mysqld (2897) io_getevents
同时，你可以用proc.name过滤器来赚取特定进程的所有事件，例如下面过滤了多有包含sshd的进程。
