# Docker container monitoring using Sysdig

**URL:** <https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724>\
**Category:** Sysdig OSS\
**Created:** [November 28, 2025, 1:20pm UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724 "2025-11-28T13:20:24Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rupesh](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Rupesh](https://community.sysdig.com/u/Rupesh)\
**Post date:** [November 28, 2025, 1:20pm UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724/1 "2025-11-28T13:20:24Z")

</div>

Hi Guys,  
I am Rupesh currently developing a toolchain to create a syscall profile for Java based docker applications.  
I am currently using sysdig to monitor .jar .so and binaries by open,openat,mmap and execve events of a docker container during the startup.

I find that while monitoring the open,openat event to check the .so files opened by java process. I have noticed that the paths for those libraries do not exists  
What could be the reason?

---

<div class="post-metadata">

**Author:** ![edsoncelio](https://sea1.discourse-cdn.com/sysdig/user_avatar/community.sysdig.com/edsoncelio/32/107_2.png) [@edsoncelio](https://community.sysdig.com/u/edsoncelio)\
**Post date:** [December 9, 2025, 1:36pm UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724/2 "2025-12-09T13:36:50Z")

</div>

Hi @Rupesh, welcome!  
Do you mind sharing more details on this? (e.g. running in container )  
I can try to reproduce here, based on my experience, it can be something related to the way that JVM works.

---

<div class="post-metadata">

**Author:** ![Rupesh](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Rupesh](https://community.sysdig.com/u/Rupesh)\
**Post date:** [December 9, 2025, 2:05pm UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724/3 "2025-12-09T14:05:04Z")

</div>

hi @edsoncelio  
the command i use to capture .jar and .so files during the container restart (ex: in this case its [solr:slim)](https://hub.docker.com/_/solr).

> •sudo sysdig --modern-bpf \ “container.name=$CNAME and evt.type in (open,openat,openat2,mmap) and evt.failed=false and (fd.name contains .so or fd.name contains .jar)” \ -p “%evt.time %evt.type %proc.pid %proc.name %fd.name %fd.typechar” \

Now, i have added a filter evt.failed = false to only record successful events but without that filter I do notice file paths are being recorded which do not exist in the container.

---

<div class="post-metadata">

**Author:** ![edsoncelio](https://sea1.discourse-cdn.com/sysdig/user_avatar/community.sysdig.com/edsoncelio/32/107_2.png) [@edsoncelio](https://community.sysdig.com/u/edsoncelio)\
**Post date:** [December 9, 2025, 2:27pm UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724/4 "2025-12-09T14:27:09Z")

</div>

Got it! And it makes sense, for those paths that doesn’t exists you can see something like this right?

`14:17:59.287492167 ENOENT openat 5186 java /opt/java/openjdk/lib/aarch64/libjli.so`

JVM tries different default search paths for shared libraries, even if the directories or files do not exist inside the container. But from sysdig side is still a `openat` event, so it’s being recorded, even if it’s not loaded successfully.

My suggestion is to filter by the successful events only, like you’re already doing!

---

<div class="post-metadata">

**Author:** ![Rupesh](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Rupesh](https://community.sysdig.com/u/Rupesh)\
**Post date:** [December 9, 2025, 2:32pm UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724/5 "2025-12-09T14:32:30Z")

</div>

I was guessing the same. Thanks for confirming.

---

<div class="post-metadata">

**Author:** ![edsoncelio](https://sea1.discourse-cdn.com/sysdig/user_avatar/community.sysdig.com/edsoncelio/32/107_2.png) [@edsoncelio](https://community.sysdig.com/u/edsoncelio)\
**Post date:** [December 9, 2025, 3:00pm UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724/6 "2025-12-09T15:00:28Z")

</div>

Great! You’re welcome!

---

<div class="post-metadata">

**Author:** ![Rupesh](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Rupesh](https://community.sysdig.com/u/Rupesh)\
**Post date:** [May 4, 2026, 11:55am UTC](https://community.sysdig.com/t/docker-container-monitoring-using-sysdig/724/7 "2026-05-04T11:55:16Z")

</div>

Hi checkout the project I have build  
I have used sysdig ebpf for my dynamic analysis

> **[GitHub - MadriSec/Prototype: EchoTrace generates least-privilege seccomp...](https://github.com/MadriSec/Prototype/tree/main)**
>
> main