Skip to main content
Version: latest

traceloop

The traceloop gadget is a syscalls flight recorder.

Getting started

Running the gadget:

$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/traceloop:latest [flags]

Guide

First, we need to run an application that generates some events.

$ kubectl create ns test-traceloop-ns
namespace/test-traceloop-ns created
$ kubectl run -n test-traceloop-ns --image busybox test-traceloop-pod --command -- sleep inf
pod/test-traceloop-pod created

Then, let's run the gadget:

$ kubectl gadget run traceloop:latest --namespace test-traceloop-ns K8S.NODE K8S.NAMESPACE K8S.PODNAME K8S.CONTAINERNAME CPU PID COMM SYSCALL PARAMETERS RET

Now, let's generate some events:

Run a command inside the pod:

$ kubectl exec -ti -n test-traceloop-ns test-traceloop-pod -- /bin/hush
/ # ls

Let's collect the syscalls:

Press Ctrl+C to collect the syscalls:

$ kubectl gadget run traceloop:latest --namespace test-traceloop-ns
K8S.NODE K8S.NAMESPACE K8S.PODNAME K8S.CONTAINERNAME CPU PID COMM SYSCALL PARAMETERS RET
^C
...
minikube-docker test-traceloop-ns test-traceloop-pod test-traceloop-pod 2 95419 ls brk brk=0 94032
minikube-docker test-traceloop-ns test-traceloop-pod test-traceloop-pod 2 95419 ls mmap addr=0, len… 14008
minikube-docker test-traceloop-ns test-traceloop-pod test-traceloop-pod 2 95419 ls access filename="/… -1 (P…
...
minikube-docker test-traceloop-ns test-traceloop-pod test-traceloop-pod 2 95419 ls write fd=1, buf="201
minikube-docker test-traceloop-ns test-traceloop-pod test-traceloop-pod 2 95419 ls exit_group error_code=0 X

Finally, clean the system:

$ kubectl delete ns test-traceloop-ns
namespace "test-traceloop-ns" deleted

Limitations

This gadget has the following limitations:

  1. It cannot be run in kubernetes context.
  2. Timestamps are not filled on kernel older than 5.7.