Sysdig Inspect

The interface visualizes sysdig capture files, presenting system‑wide, container‑level, network, and application activity in an organized tile layout. Each tile shows a metric, its trend, and allows sub‑second granularity, enabling users to spot micro‑trends and correlate multiple metrics to locate performance or security hotspots. Drill‑down workflows let users explore processes, files, network connections, and payloads, with an optional sysdig mode for full system‑call detail.

It is intended for engineers and analysts who need to troubleshoot intermittent issues, investigate security incidents, or understand container behavior on Linux systems. By loading captures produced with sysdig, users can examine every byte of file or network I/O (when captured with appropriate snaplen) and trace the exact sequence of events that led to a problem.

The tool is distributed as a Docker image, as well as native installers for macOS, Windows, and Linux (RPM/DEB). It runs a web UI on port 3000, and the source and release notes are hosted on GitHub, with community support available via a public Slack channel.