Summoning the spirit (and more importantly the expertise) of brendangregg here. From the home page sysdig "capture[s] system state and activity", but by levera

Summoning the spirit (and more importantly the expertise) of brendangregg here. From the home page sysdig "capture[s] system state and activity", but by leveraging specifically what? From https://sysdig.com/blog/sysdig-vs-dtrace-vs-strace-a-technical-discussion/ https://sysdig.com/blog/sysdig-vs-dtrace-vs-strace-a-technic...: "First, events are captured in the kernel by a small driver, called sysdig-probe, which leverages a kernel facility called tracepoints." That makes it sound like it's quite similar to the ftrace kernel tracer by instrumenting the various event tracepoints (/sys/kernel/debug/tracing/available_events) conveniently strewn throughout the kernel source--is this indeed the case? Alternatively, is sysdig doing something differently? {k,u}probes? Sampling similar to, perhaps say, perf's capabilities? The Linux tracing/profiling landscape is murky enough (littered with tools like SystemTap, LTTng, and so forth) and I'd like to know where this tool fits into an analysis work-flow--and more importantly, what's it's using (at a low-level) to gather data. I'd appreciate any and all clarification. Cheers.