Update help and man page

userspace/sysdig/man/csysdig.8

@@ -1,3 +1,6 @@
+.\" Automatically generated by Pandoc 1.15.1.1
+.\"
+.hy
 .TH "" "" "" "" ""
 .SS NAME
 .PP
@@ -16,37 +19,19 @@ csysdig has been designed to mimic tools like \f[B]top\f[] and
 .IP \[bu] 2
 Support for both live analysis and sysdig trace files.
 Trace files can come from the same machine or from another machine.
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 Visibility into a broad range of metrics, including CPU, memory, disk
 I/O, network I/O.
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 Ability to observe input/output activity for processes, files, network
 connections and more.
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 Ability to drill down into processes, files, network connections and
 more to further explore their behavior.
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 Full customization support.
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 Support for sysdig\[aq]s filtering language.
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 Container support by design.
 .PP
@@ -71,26 +56,14 @@ Here are some basic tips to get you started with sysdig:
 If you run csysdig without arguments, it will display live system data,
 updating every 2 seconds.
 To analyze a trace file, use the \-r command line flag.
-.PD 0
-.P
-.PD
 .IP "2." 3
 You can switch to a different view by using the \f[I]F2\f[] key.
-.PD 0
-.P
-.PD
 .IP "3." 3
 You can to drill down into a selection by clicking \f[I]enter\f[].
 You can navigate back by typing \f[I]backspace\f[].
-.PD 0
-.P
-.PD
 .IP "4." 3
 You can observe input/output for the currently selected entity by typing
 \f[I]F5\f[]
-.PD 0
-.P
-.PD
 .IP "5." 3
 You can see sysdig events for the currently selected entity by typing
 \f[I]F6\f[]
@@ -197,6 +170,12 @@ Show the help page for the currently displayed view.
 .PD
 Open the view\[aq]s actions panel.
 .PP
+\f[B]F9, >\f[]
+.PD 0
+.P
+.PD
+Open the column sort panel.
+.PP
 \f[B]F10, q\f[]
 .PD 0
 .P
@@ -217,6 +196,12 @@ content.
 .PD
 Pause screen updates.
 .PP
+\f[B]\f[C]<shift>\ <1\-9>\f[]\f[]
+.PD 0
+.P
+.PD
+sort column \f[C]<n>\f[]
+.PP
 \f[B]F1, h, ?\f[]
 .PD 0
 .P
@@ -276,24 +261,35 @@ Pause screen updates.
 .P
 .PD
 Go to line.
-.SS MOUSE USAGE
-.IP \[bu] 2
-Clicking on column headers lets you sort the table.
+.SS Spectrogram Window
+.PP
+\f[B]F2\f[]
 .PD 0
 .P
 .PD
-.IP \[bu] 2
-Double clicking on row entries performs a drill down.
+Show the view picker.
+This will let you switch to another view.
+.PP
+\f[B]p\f[]
 .PD 0
 .P
 .PD
+Pause/Resume the visualization.
+.PP
+\f[B]Backspace\f[]
+.PD 0
+.P
+.PD
+Navigate back to the previous view.
+.SS MOUSE USAGE
+.IP \[bu] 2
+Clicking on column headers lets you sort the table.
+.IP \[bu] 2
+Double clicking on row entries performs a drill down.
 .IP \[bu] 2
 Clicking on the filter string at the top of the screen (the text after
 \[aq]Filter:\[aq]) lets you change the sysdig filter and customize the
 view content.
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 You can use the mouse on the entries in the menu at the bottom of the
 screen to perform their respective actions.
@@ -335,6 +331,18 @@ E.g.
 The API server can also be specified via the environment variable
 SYSDIG_K8S_API.
 .PP
+\f[B]\-K\f[] \f[I]filename\f[],
+\f[B]\-\-k8s\-api\-cert=\f[]\f[I]filename\f[]
+.PD 0
+.P
+.PD
+Use the provided certificate file name to authenticate with the K8S API
+server.
+Filename must be a full absolute or relative (to the current directory)
+path to the certificate file.
+The certificate can also be specified via the environment variable
+SYSDIG_K8S_API_CERT.
+.PP
 \f[B]\-l\f[], \f[B]\-\-list\f[]
 .PD 0
 .P
@@ -381,7 +389,7 @@ Capture the first \f[I]len\f[] bytes of each I/O buffer.
 By default, the first 80 bytes are captured.
 Use this option with caution, it can generate huge trace files.
 .PP
-\f[B]\-v\f[] \f[I]view\f[]id_, \f[B]\-\-views\f[]=\f[I]view\f[]id_
+\f[B]\-v\f[] \f[I]view_id\f[], \f[B]\-\-views\f[]=\f[I]view_id\f[]
 .PD 0
 .P
 .PD

userspace/sysdig/man/sysdig.8

@@ -1,3 +1,6 @@
+.\" Automatically generated by Pandoc 1.15.1.1
+.\"
+.hy
 .TH "" "" "" "" ""
 .SS NAME
 .PP
@@ -33,41 +36,20 @@ single line, with the following format:
 where:
 .IP \[bu] 2
 evt.num is the incremental event number
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 evt.time is the event timestamp
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 evt.cpu is the CPU number where the event was captured
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 proc.name is the name of the process that generated the event
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 thread.tid id the TID that generated the event, which corresponds to the
 PID for single thread processes
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 evt.dir is the event direction, > for enter events and < for exit events
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 evt.type is the name of the event, e.g.
 \[aq]open\[aq] or \[aq]read\[aq]
-.PD 0
-.P
-.PD
 .IP \[bu] 2
 evt.args is the list of event arguments.
 .PP
@@ -119,8 +101,8 @@ The list of available fields can be obtained with \[aq]sysdig \-l\[aq].
 .P
 .PD
 Filter expressions can use one of these comparison operators:
-\f[I]=\f[], \f[I]!=\f[], \f[I]<\f[], \f[I]<=\f[], \f[I]>\f[],
-\f[I]>=\f[], \f[I]contains\f[], \f[I]in\f[] and \f[I]exists\f[].
+\f[I]=\f[], \f[I]!=\f[], \f[I]\f[], \f[I]>=\f[], \f[I]contains\f[],
+\f[I]in\f[] and \f[I]exists\f[].
 e.g.
 .RS
 .PP
@@ -352,6 +334,18 @@ E.g.
 The API server can also be specified via the environment variable
 SYSDIG_K8S_API.
 .PP
+\f[B]\-K\f[] \f[I]filename\f[],
+\f[B]\-\-k8s\-api\-cert=\f[]\f[I]filename\f[]
+.PD 0
+.P
+.PD
+Use the provided certificate file name to authenticate with the K8S API
+server.
+Filename must be a full absolute or relative (to the current directory)
+path to the certificate file.
+The certificate can also be specified via the environment variable
+SYSDIG_K8S_API_CERT.
+.PP
 \f[B]\-L\f[], \f[B]\-\-list\-events\f[]
 .PD 0
 .P
@@ -371,6 +365,12 @@ Use \-lv to get additional information for each field.
 .PD
 Don\[aq]t convert port numbers to names.
 .PP
+\f[B]\-M\f[] \f[I]num_seconds\f[]
+.PD 0
+.P
+.PD
+Stop collecting after reaching
+.PP
 \f[B]\-n\f[] \f[I]num\f[], \f[B]\-\-numevents\f[]=\f[I]num\f[]
 .PD 0
 .P

userspace/sysdig/sysdig.cpp

@@ -117,7 +117,7 @@ static void usage()
 "                    'hidden' so that they won't appear when reading the file.\n"
 "                    Be aware that using this flag might generate substantially\n"
 "                    bigger traces files.\n"
-" filter-proclist    apply the filter to the process table\n"
+" --filter-proclist  apply the filter to the process table\n"
 "                    a full dump of /proc is typically included in any trace file\n"
 "                    to make sure all the state required to decode events is in the\n"
 "                    file. This could cause the file to contain unwanted or sensitive\n"