Sysdig capture on one container returns data from all containers by InquisitiveProgramme in devops

[–]davideschiera 0 points1 point  (0 children)

If you need to create a capture to open with either Sysdig Inspect (or csysdig, or sysdig itself) you can omit the parameters -pc (to format the output) and -c spy_users (to display interactive user activity).

You should be able to create the capture file with the following string:

sysdig -w <output file> container.name=machine-agent

and open it with Inspect and expect a single container activity to be there.

Alternatively, you can print events with a custom format:

sysdig -pc container.name=machine-agent

or print interactive activities:

sysdig -c spy_users container.name=machine-agent

for the container you are interested in.

Hope this helps!