Gadgets
This section provides documentation for the Gadgets hosted in the gadgets folder of the Inspektor Gadget source tree. Check Artifact HUB to get a more complete list of Gadgets.
Almost all built-in gadgets have been ported, however we're still missing few of them:
The ported built-in gadgets have been deprecated in v0.37.0 (February 2025) and will be removed in v0.42.0 (July 2025). Read Switching to image-based gadgets to learn more.
📄️ audit_seccomp
The audit seccomp gadget provides a stream of events with syscalls that had
📄️ deadlock
Use uprobe to trace pthreadmutexlock and pthreadmutexunlock in libc.so and detect potential deadlocks.
📄️ fdpass
The fdpass gadget traces file descriptor passing via a unix socket (SCM_RIGHTS). Currently it only shows the sender side.
📄️ fsnotify
The fsnotify gadget detects applications using inotify or fanotify and enriches the events with the process-related metadata.
📄️ profile_blockio
The profile_blockio gadget gathers information about the usage of the
📄️ profile_tcprtt
The profile_tcprtt gadget generates a histogram distribution of the TCP
📄️ snapshot_process
The snapshot_process shows running processes.
📄️ snapshot_socket
The snapshot_socket shows existing sockets.
📄️ top_blockio
The top_blockio gadget provides a periodic list of input/output block device activity.
📄️ top_file
The top_file gadget reports periodically the read/write activity by file.
📄️ top_tcp
The top_tcp gadget reports tcp send receive activity by connection.
📄️ trace_bind
The trace_bind gadget is used to stream socket binding syscalls.
📄️ trace_capabilities
The trace_capabilities gadget allows us to see what capability security checks are triggered by applications
📄️ trace_dns
The trace_dns gadget is used to trace DNS queries and responses.
📄️ trace_exec
The trace_exec gadget notifies when new processes are executed.
📄️ trace_fsslower
The trace fsslower gadget streams file operations (open, read, write and fsync)
📄️ trace_lsm
a strace for LSM tracepoints
📄️ trace_malloc
use uprobe to trace malloc and free in libc.so
📄️ trace_mount
The trace_mount gadget emits events when mount and unmount system calls are made.
📄️ trace_oomkill
The trace_oomkill gadget is used to trace OOM kill events.
📄️ trace_open
The trace_open gadget emits events when files are opened.
📄️ trace_signal
trace signal
📄️ trace_sni
The trace_sni gadget tracks Server Name Indication (SNI) from TLS requests.
📄️ trace_ssl
Captures data on read/recv or write/send functions of OpenSSL, GnuTLS, NSS and Libcrypto
📄️ trace_tcp
The trace_tcp gadget tracks tcp connect, accept and close.
📄️ trace_tcpconnect
The gadget was merged into the trace_tcp gadget in version v0.37.0.
📄️ trace_tcpdrop
The trace_tcpdrop gadget tracks TCP kernel-dropped packets/segments.
📄️ trace_tcpretrans
The trace_tcpretrans gadget tracks TCP retransmissions.
🗃️ Built-in
8 items
📄️ Swithing to image-based Gadgets
This guide covers how to switch from built-in Gadgets to image-based Gadgets.