Gadgets
This section provides documentation for the Gadgets hosted in the gadgets folder of the Inspektor Gadget source tree. Check Artifact HUB to get a more complete list of Gadgets.
📄️ advise networkpolicy
The advise networkpolicy gadget monitors the network activity in the specified namespaces
📄️ advise_seccomp
The seccomp profile advisor gadget records syscalls that are issued in a
📄️ audit_seccomp
The audit seccomp gadget provides a stream of events with syscalls that had
📄️ bpfstats
The bpfstats Gadget provides CPU and memory usage for Gadgets and eBPF programs.
📄️ deadlock
Use uprobe to trace pthreadmutexlock and pthreadmutexunlock in libc.so and detect potential deadlocks.
📄️ fdpass
The fdpass gadget traces file descriptor passing via a unix socket (SCM_RIGHTS). Currently it only shows the sender side.
📄️ fsnotify
The fsnotify gadget detects applications using inotify or fanotify and enriches the events with the process-related metadata.
📄️ profile_blockio
The profile_blockio gadget gathers information about the usage of the
📄️ profile_cpu
The profile cpu gadget takes samples of stack traces.
📄️ profile_qdisc_latency
The profileqdisclatency gadget gathers information about the usage of the
📄️ profile_tcprtt
The profile_tcprtt gadget generates a histogram distribution of the TCP
📄️ snapshot_file
The snapshot_file gadget shows open files for running processes.
📄️ snapshot_process
The snapshot_process shows running processes.
📄️ snapshot_socket
The snapshot_socket shows existing sockets.
📄️ tcpdump
The tcpdump gadget captures packets in container contexts and allows applying pcap-compatible filters. This is usually
📄️ top_blockio
The top_blockio gadget provides a periodic list of input/output block device activity.
📄️ top_file
The top_file gadget reports periodically the read/write activity by file.
📄️ top_process
The top_process gadget periodically reports process statistics, including CPU usage, memory usage, and other process information.
📄️ top_tcp
The top_tcp gadget reports tcp send receive activity by connection.
📄️ trace_bind
The trace_bind gadget is used to stream socket binding syscalls.
📄️ trace_capabilities
The trace_capabilities gadget allows us to see what capability security checks are triggered by applications
📄️ trace_dns
The trace_dns gadget is used to trace DNS queries and responses.
📄️ trace_exec
The trace_exec gadget notifies when new processes are executed.
📄️ trace_fsslower
The trace fsslower gadget streams file operations (open, read, write and fsync)
📄️ trace_lsm
a strace for LSM tracepoints
📄️ trace_malloc
use uprobe to trace malloc and free in libc.so
📄️ trace_mount
The trace_mount gadget emits events when mount and unmount system calls are made.
📄️ trace_oomkill
The trace_oomkill gadget is used to trace OOM kill events.
📄️ trace_open
The trace_open gadget emits events when files are opened.
📄️ trace_signal
trace signal
📄️ trace_sni
The trace_sni gadget tracks Server Name Indication (SNI) from TLS requests.
📄️ trace_ssl
Captures data on read/recv or write/send functions of OpenSSL, GnuTLS, NSS and Libcrypto
📄️ trace_tcp
The trace_tcp gadget tracks tcp connect, accept and close.
📄️ trace_tcpdrop
The trace_tcpdrop gadget tracks TCP kernel-dropped packets/segments.
📄️ trace_tcpretrans
The trace_tcpretrans gadget tracks TCP retransmissions.
📄️ traceloop
The traceloop gadget is used to capture system calls in real-time, acting as a flight recorder for your applications.
📄️ ttysnoop
The ttysnoop gadget watches the output from a tty or pts device.
📄️ Switching to image-based Gadgets
This guide covers how to switch from built-in Gadgets to image-based Gadgets.