Map the container syscall events using sysdig

dig-container.sh

#!/bin/bash

ignore_evts="futex switch clock_gettime io_getevents sched_getaffinity getrusage nanosleep rt_sigaction rt_sigprocmask ioctl sched_yield sigreturn times"
declare -A map

[[ "$1" == "" ]] && echo "Need container name as input" && exit 1
[[ $UID -ne 0 ]] && echo "Need to exec as root" && exit 1
[[ ! -x "$(which jq)" ]] && echo "Need jq command (try, apt install jq)" && exit 1
[[ ! -x "$(which sysdig)" ]] && echo "Need sysdig command (try, apt install sysdig)" && exit 1

dump_map()
{
    clear
    for evt in "${!map[@]}"; do
        printf "%15s = %s\n" "$evt" "${map[$evt]}"
    done | sort -n -k3 | column
}

dig_events()
{
    cmdline="container.name=$1"
    for evt in $ignore_evts; do
        cmdline="$cmdline and evt.type!=$evt"
    done
    SECONDS=0
    echo "listening for events..."
    while read line; do
        evt=`echo "$line" | jq -r '.["evt.type"]' 2>/dev/null`
        [[ "$evt" == "" ]] && continue
        [[ ! ${map[$evt]+_} ]] && map[$evt]=0
        ((map[$evt]++))
        [[ $SECONDS -gt 2 ]] && SECONDS=0 && dump_map
    done < <(sysdig -j "$cmdline")
}

dig_events $*