# Install sysdig with Homebrew, MacPorts, Nix, pacman, apt, zypper System-level exploration and troubleshooting tool. Version 0.41.4 via Homebrew; verified 2026-05-20. ## Install ```sh sudo av install brew:sysdig ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install sysdig ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install sysdig ``` Evidence: MacPorts ports tree: sysutils/sysdig/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Nix (92%): ```sh nix profile install nixpkgs#sysdig ``` Evidence: nixpkgs package indexes: sysdig from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - pacman (92%): ```sh sudo pacman -S sysdig ``` Evidence: Arch Linux sync databases: sysdig from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - Ubuntu apt (92%): ```sh sudo apt install sysdig ``` Evidence: Ubuntu 24.04 LTS package indexes: sysdig from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz - zypper (92%): ```sh sudo zypper install sysdig ``` Evidence: openSUSE Tumbleweed package metadata: sysdig from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:sysdig - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.41.4 - **Source summary:** System-level exploration and troubleshooting tool - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 AND (GPL-2.0-only OR MIT) AND (GPL-2.0-only WITH Linux-syscall-note) - **Source archive:** - **Last updated:** 2026-05-20T10:12:52-04:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - csysdig (cli) - scap-driver-loader (cli) - sysdig (cli) - csysdig (alias) - scap-driver-loader (alias) - sysdig (alias) ## Dependencies - jsoncpp - luajit - ncurses - re2 - tbb - uthash - yaml-cpp ## Build dependencies - cmake - nlohmann-json - pkgconf - valijson ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.41.4 - Package-manager updated: 2026-05-20 - Local data: ok - Upstream repository: https://github.com/draios/sysdig - Upstream latest detected: 0.41.4 (current) ## Project history and usage sysdig is a system-visibility and troubleshooting CLI that became important to package and operations culture by bringing packet-capture-style workflows to system calls, processes, files, networking, and containers. ### Project history Sysdig's official announcement introduced it as an open-source system exploration tool focused on system-level monitoring and troubleshooting. The announcement connected the project to the founders' earlier work on Wireshark and WinPcap and described sysdig as an evolution from network packets toward host and process activity. The GitHub README presents sysdig as a universal system visibility tool with native container support and describes `csysdig` as a curses UI for the same data. It emphasizes kernel-level capture of system calls and OS events, trace files, and later analysis in a way analogous to tcpdump and Wireshark for networks. Sysdig's company history says Loris Degioanni founded Sysdig in 2013 and that sysdig OSS was created in 2014 as the first tool for deep, system-call-level introspection into containers. ### Adoption history The README documents container-based usage through the official Docker image and distribution-specific deb/rpm release packages. The input package facts list Homebrew, MacPorts, Nix, Arch, Ubuntu, and zypper packages, showing the tool's spread across both macOS package-manager and Linux distribution channels. Sysdig later became part of a broader open-source security family. A Sysdig Open Source Community announcement groups sysdig OSS with Wireshark, Falco, and Stratoshark, and describes sysdig OSS as the foundation of open-source system visibility for cloud-native forensics and incident response. ### How it is used sysdig is used from the shell to inspect live system activity or capture trace files for later troubleshooting. The README summarizes its pitch as combining ideas from tools such as strace, tcpdump, htop, iftop, and lsof. The `csysdig` executable gives a terminal UI for interactive exploration, while the `sysdig` CLI remains the package-manager-visible entry point for scripts, incident response, and low-level inspection. ### Why package nerds care sysdig matters to package nerds because it sits at the boundary between ordinary userland packages and kernel-facing observability: packaging has to account for drivers, containers, distribution releases, and security expectations. It also helped make container-aware troubleshooting a packageable CLI experience, not just a hosted monitoring product. ### Timeline - 2013: Loris Degioanni founded Sysdig. - 2014: sysdig OSS was created for system-call-level introspection into containers. - 2014: Sysdig was publicly announced as an open-source system exploration tool. - 2016: Sysdig created Falco, a related runtime security project. - 2025: Sysdig announced an Open Source Community grouping sysdig OSS with Wireshark, Falco, and Stratoshark. ### Related projects - csysdig is the curses-based terminal UI shipped with sysdig. - Falco grew from the same open-source security lineage and uses runtime/event ideas adjacent to sysdig. - Wireshark and tcpdump are recurring reference points in official sysdig materials because sysdig adapts packet-capture-style analysis to host and container activity. ### Sources - - - - - input source_facts.package-manager ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** sysdig - **Version Scheme:** 0 - **Revision:** 4 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - sysdig: normalized package name match | nixpkgs package indexes: sysdig from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - Ubuntu apt - sysdig - 0.36.0+repack-1: normalized package name match | Ubuntu 24.04 LTS package indexes: sysdig from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | system-level exploration and troubleshooting tool | https://www.sysdig.com/ - pacman - sysdig - 0.41.4-2: normalized package name match | Arch Linux sync databases: sysdig from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Open source system-level exploration and troubleshooting tool | https://www.sysdig.com/ - zypper - sysdig - 0.41.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: sysdig from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | System-level exploration | https://github.com/draios/sysdig - zypper - sysdig-bash-completion - 0.41.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: sysdig-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Bash completion for sysdig | https://github.com/draios/sysdig - zypper - sysdig-zsh-completion - 0.41.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: sysdig-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Zsh completion for sysdig | https://github.com/draios/sysdig - MacPorts - sysdig: normalized package name match | MacPorts ports tree: sysutils/sysdig/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Cloud CLI packages](https://www.automicvault.com/pkg/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [luajit](https://www.automicvault.com/pkg/brew/luajit/) - Runtime dependency declared by Homebrew. - [ncurses](https://www.automicvault.com/pkg/brew/ncurses/) - Runtime dependency declared by Homebrew. - [cmake](https://www.automicvault.com/pkg/brew/cmake/) - Build dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [bpftop](https://www.automicvault.com/pkg/brew/bpftop/) - Shares av.db curated category or tags: cli, observability, system. - [metricbeat](https://www.automicvault.com/pkg/brew/metricbeat/) - Shares av.db curated category or tags: cli, observability, system. - [rhit](https://www.automicvault.com/pkg/brew/rhit/) - Shares av.db curated category or tags: cli, observability, system. - [conmon](https://www.automicvault.com/pkg/brew/conmon/) - Shares av.db curated category or tags: cli, containers, system. - [crun](https://www.automicvault.com/pkg/brew/crun/) - Shares av.db curated category or tags: cli, containers, system. - [ctop](https://www.automicvault.com/pkg/brew/ctop/) - Shares av.db curated category or tags: cli, containers, system. - [distrobox](https://www.automicvault.com/pkg/brew/distrobox/) - Shares av.db curated category or tags: cli, containers, system. - [docuum](https://www.automicvault.com/pkg/brew/docuum/) - Shares av.db curated category or tags: cli, containers, system. - [qdmr](https://www.automicvault.com/pkg/brew/qdmr/) - Both packages work with overlapping file formats or content types. Shared terms: cli, cpp, system, yaml, yaml-cpp. ## Combined YAML source View the package source record on GitHub. [combined/sysdig.yml](https://github.com/automic-vault/db/blob/main/combined/sysdig.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph