linux服务器监控工具

监控一个进程发出和接收的系统调用 -- strace
命令行监控原始网络通信 -- tcpdump
跟踪打开的文件 -- lsof

sysdig的诞生 -- 集strace tcpdump lsof于一身的工具，使用lua集成的工具。
可以分析linux系统的现状，且可一把系统状态保存到一个转存文件用于离线检测。
可以自己使用脚本扩展其他功能。

sysdig安装脚本下载地址：
curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | bash
sysdig的安装脚本内容：

#!/bin/bash
#
# Copyright (C) 2013-2014 Draios inc.
#
# This file is part of sysdig.
#
# sysdig is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 as
# published by the Free Software Foundation.
#
# sysdig is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with sysdig.  If not, see <http://www.gnu.org/licenses/>.
#
set -e

function install_rpm {
if ! hash curl > /dev/null 2>&1; then
echo "* Installing curl"
yum -q -y install curl
fi

if ! yum -q list dkms > /dev/null 2>&1; then
echo "* Installing EPEL repository (for DKMS)"
if [ $VERSION -eq 7 ] && [ $DISTRO = "centos" ]; then
rpm --quiet -i http://mirrors.kernel.org/centos/7/extras/x86_64/Packages/epel-release-7-5.noarch.rpm elif [ $VERSION -eq 7 ]; then
rpm --quiet -i http://mirrors.kernel.org/fedora-epel/7/x86_64/e/epel-release-7-5.noarch.rpm else
rpm --quiet -i http://mirrors.kernel.org/fedora-epel/6/i386/epel-release-6-8.noarch.rpm fi
fi

echo "* Installing Sysdig public key"
rpm --quiet --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public echo "* Installing Sysdig repository"
curl -s -o /etc/yum.repos.d/draios.repo http://download.draios.com/stable/rpm/draios.repo echo "* Installing kernel headers"
KERNEL_VERSION=$(uname -r)
if [[ $KERNEL_VERSION == *PAE* ]]; then
yum -q -y install kernel-PAE-devel-${KERNEL_VERSION%.PAE} || kernel_warning
elif [[ $KERNEL_VERSION == *stab* ]]; then
# It's OpenVZ kernel and we should install another package
yum -q -y install vzkernel-devel-$KERNEL_VERSION || kernel_warning
else
yum -q -y install kernel-devel-$KERNEL_VERSION || kernel_warning
fi
echo "* Installing Sysdig"
yum -q -y install sysdig
}

function install_deb {
export DEBIAN_FRONTEND=noninteractive

if ! hash curl > /dev/null 2>&1; then
echo "* Installing curl"
apt-get -qq -y install curl < /dev/null
fi

echo "* Installing Sysdig public key"
curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | apt-key add -
echo "* Installing Sysdig repository"
curl -s -o /etc/apt/sources.list.d/draios.list http://download.draios.com/stable/deb/draios.list apt-get -qq update < /dev/null
echo "* Installing kernel headers"
apt-get -qq -y install linux-headers-$(uname -r) < /dev/null || kernel_warning
echo "* Installing Sysdig"
apt-get -qq -y install sysdig < /dev/null
}

function unsupported {
echo 'Unsupported operating system. Please consider writing to the mailing list at'
echo 'https://groups.google.com/forum/#!forum/sysdig or trying the manual'
echo 'installation.'
exit 1
}

function kernel_warning {
echo "Unable to find kernel development files for the current kernel version" $(uname -r)
echo "This usually means that your system is not up-to-date or you installed a custom kernel version."
echo "The installation will continue but you'll need to install these yourself in order to use sysdig."
echo 'Please write to the mailing list at https://groups.google.com/forum/#!forum/sysdig' echo "if you need further assistance."
}

if [ $(id -u) != 0 ]; then
echo "Installer must be run as root (or with sudo)."
exit 1
fi

echo "* Detecting operating system"

ARCH=$(uname -m)
if [[ ! $ARCH = *86 ]] && [ ! $ARCH = "x86_64" ]; then
unsupported
fi

if [ -f /etc/debian_version ]; then
if [ -f /etc/lsb-release ]; then
. /etc/lsb-release
DISTRO=$DISTRIB_ID
VERSION=${DISTRIB_RELEASE%%.*}
else
DISTRO="Debian"
VERSION=$(cat /etc/debian_version | cut -d'.' -f1)
fi

case "$DISTRO" in

"Ubuntu")
if [ $VERSION -ge 10 ]; then
install_deb
else
unsupported
fi
;;

"LinuxMint")
if [ $VERSION -ge 9 ]; then
install_deb
else
unsupported
fi
;;

"Debian")
if [ $VERSION -ge 6 ]; then
install_deb
elif [[ $VERSION == *sid* ]]; then
install_deb
else
unsupported
fi
;;

*)
unsupported
;;

esac

elif [ -f /etc/system-release-cpe ]; then
DISTRO=$(cat /etc/system-release-cpe | cut -d':' -f3)
VERSION=$(cat /etc/system-release-cpe | cut -d':' -f5 | cut -d'.' -f1 | sed 's/[^0-9]*//g')

case "$DISTRO" in

"oracle" | "centos" | "redhat")
if [ $VERSION -ge 6 ]; then
install_rpm
else
unsupported
fi
;;

"amazon")
install_rpm
;;

"fedoraproject")
if [ $VERSION -ge 13 ]; then
install_rpm
else
unsupported
fi
;;

*)
unsupported
;;

esac

else
unsupported
fi

具体的使用方法：http://blog.jobbole.com/98717/