Sysdig is open source, system-level exploration: capture system state and
activity from a running Linux instance, then save, filter and analyze.
Think of it as strace + tcpdump + lsof + awesome sauce.
With a little Lua cherry on top.

Sysdig instruments your physical and virtual machines at the OS level
by installing into the Linux kernel and capturing system calls and other
OS events. Then, using sysdig's command line interface, you can filter and
decode these events in order to extract useful information. Sysdig can be used
to inspect systems live in real-time, or to generate trace files that can be
analyzed at a later stage.