Inspektor Gadget

📄️ Gadget audit-seccomp

The Audit Seccomp gadget provides a stream of events with syscalls that had

bindsnoop traces the kernel functions performing socket binding.

The biolatency gadget traces block device I/O (disk I/O), and records the

capabilities traces security capability checks"

The dns gadget traces DNS requests.

ebpftop shows cpu time used by ebpf programs.

execsnoop shows new created processes, with container details.

filetop shows reads and writes by file, with container details.

fsslower shows open, read, write and fsync operations slower than a threshold

mountsnoop traces mount and umount syscalls

The network-graph gadget monitors the network activity in the specified pods and records the list of TCP connections and UDP streams.

oomkill monitors when OOM killer is triggered and kills a process.

opensnoop traces open() system calls

The process-collector gadget gathers information about running processes

The seccomp gadget traces system calls for each container in order to generate

sigsnoop traces all signals sent on the system.

The snisnoop gadget retrieves Server Name Indication (SNI) from TLS requests.

The socket-collector gadget gathers information about TCP and UDP sockets.

tcpconnect traces connect() system calls

Trace tcp connect, accept and close

The traceloop gadget traces system calls in a similar way to strace but with