AppScope is an open source, runtime-agnostic instrumentation utility for any Linux command or application. It helps users explore, understand, and gain visibility with no code modification.
AppScope provides the fine-grained observability of a proxy/service mesh, without the latency of a sidecar. It emits APM-like metric and event data, in open formats, to existing log and metric tools.
It’s like strace meets tcpdump – but with consumable output for events like file access, DNS, and network activity, and StatsD-style metrics for applications. AppScope can also look inside encrypted payloads, offering WAF-like visibility without proxying traffic.
graph LR A[Application] --> B[libscope] A[Application]--> C[libgnutls] A[Application]--> D[libc] C --> D B --> D B --> C D --> I[Kernel] B --> E[In-memory Queue] E -.-> F[Reporting Thread] F --> G[Network Destination] F --> H[File System Destination] style B fill:#f3ffec,stroke:#89db70 style E fill:#fafafa,stroke:#a6a6a6 style F fill:#fafafa,stroke:#a6a6a6 style G fill:#fafafa,stroke:#a6a6a6 style H fill:#fafafa,stroke:#a6a6a6
Before you begin, make sure that your environment meets AppScope requirements.
Next, you can obtain AppScope three ways:
- Get the container image from Docker Hub and run AppScope in it.
- Check out the code from this project, then build and run AppScope in your Linux environment.
- Get the binaries from the CDN, and run them in your Linux environment.
The container image at Docker Hub and binaries at the CDN are updated for each new release of this project.
Once you have downloaded and/or built AppScope, try out some simple commands:
Scope a new process like top with
scope top. Try substituting
scope metricsto see the results.
Attach to a process that is already running. Run
ps -efand find the process ID (PID) of a command or program you would like to scope. Attach to and scope the running process with
scope attach PID. Run
scope dashto watch events live.
See the website docs for the full story of how to use AppScope.
AppScope is not built or distributed like most traditional Linux software.
- Insofar as possible, we want AppScope binaries to be Build Once, Run Anywhere. To approach this goal, we build with a version of glibc that is (1) recent enough that the resulting binary contains references to versions of functions in the glibc library that are still supported in the latest glibc, yet (2) old enough that the binaries can run on a wide range of Linux platforms without having to rebuild locally. .
- We don't build OS installation packages like DEBs or RPMs. This way, when you want to investigate a running system or build a custom container image, you can simply drop AppScope in and use it.
Pull a copy of the code with:
git clone https://github.com/criblio/appscope.git cd appscope
If you are on Ubuntu, install the build dependencies with:
Then, build and test the code with:
make all test
If you aren't on Ubuntu, or would prefer not to install the dependencies, ensure that Docker, BuildX, and
make are installed, then build in a container with:
Either way, the resulting binaries will be in
lib/linux/$(uname -m)/libscope.so and
We support building
x86_64 (amd64) or
aarch64 (arm64/v8) binaries by adding
ARCH=aarch64 to the
make build command. See the BUILD doc for details.
On the AppScope Website:
- Learn about the CLI commands in more depth.
- Get an overview of AppScope beyond the CLI.
- Discover what people are doing with AppScope.
- Review advanced examples.
- View the Changelog and Known Issues.
- See what happens when you connect AppScope to Cribl Stream or Cribl Edge.
The content on that site is built from the website/ directory in this project.
Elsewhere, you can:
- Complete the AppScope Fundamentals sandbox, a tutorial that takes about 30 minutes.
- Join the Cribl Community on Slack. The
#appscopechannel is where you'll find developers who contribute to this project.
- Watch this video review of AppScope to learn about it's capabilities and use cases.
If you're interested in contributing to the project, you can:
- Take a look at current discussions and issues in GitHub.
- See our developer guides in the docs/ directory in this repository.
- Submit any feature requests and defect reports at https://github.com/criblio/appscope.
AppScope is licensed under the Apache License, Version 2.0.