Sysdig To the Root Of the Problem

Troubleshooting requires understanding the problem at sufficient depth to apply corrective measures. How do we gain that understanding? As the scientific method teaches us, we match theory to observation.
This presentation gives an overview of process execution at the system call and kernel level (theory). We then review sysdig, a relatively new tool for system inspection (observation). Finally, we review several use cases where things are awry, matching our theory to our observation to find a basis for applying corrective action.