Skip to content

Getting Started

Jump to bottom
Xiankun Chen edited this page Mar 25, 2026 · 5 revisions

Welcome to NoDrop! Nodrop is a provenance collector which addresses the “data integrity vs. efficiency dilemma” without introducing significant extra overhead.If this is your first time trying to use NoDrop, then you've come to the right place.

Install

First, if you haven't already, you'll need to install sysdig.

Running NoDrop

After installing NoDrop, you can start monitoring processes using the nodrop command-line interface.

NoDrop runs a kernel module and a user-space monitor that captures system events and optionally processes them with Lua scripts (Chisels).

Start NoDrop

To start NoDrop monitoring:

nodrop start

By default, NoDrop runs without any analysis script and simply prepares the monitoring environment.

You can also start NoDrop with a Lua script (Chisel):

nodrop start /path/to/script.lua

In this mode, captured events will be processed by the provided Lua script.

Stop NoDrop

To stop NoDrop monitoring:

nodrop stop

This will:

  • Stop event monitoring
  • Terminate the user-space monitor

Next Steps

Once NoDrop is running, you can:

  • Learn how to use NoDrop in the User Guide
  • Explore real-world usage examples
  • Write custom analysis scripts using Chisels

Clone this wiki locally