sysdig uses "tracepoints", a feature of the Linux Kernel documented here: https://www.kernel.org/doc/Documentation/trace/tracepoints.txt https://www.kernel.org/

sysdig uses "tracepoints", a feature of the Linux Kernel documented here: https://www.kernel.org/doc/Documentation/trace/tracepoints.txt https://www.kernel.org/doc/Documentation/trace/tracepoints.t... The tracing capabilities are then tuned for monitoring and troubleshooting. So keeping the overhead as low as possible and making it usable on production environments.