Sysdig instruments your physical and virtual machines at the OS level by installing into the Linux kernel and capturing system calls and other OS events. 
Then, using sysdig's command line interface, you can filter and decode these events in order to extract useful information. 
Sysdig can be used to inspect systems live in real-time, or to generate trace files that can be analyzed at a later stage.