Hey everyone, I'm diving into Sysdig for container monitoring and security at my company. I've been setting up a proof-of-concept and hit a basic architectural question that I can't quite nail from the docs.
I see that Sysdig offers two primary agents: the Monitor agent (for metrics, dashboards, performance) and the Secure agent (for runtime security, compliance, vulnerability scanning). The deployment guides show them as separate DaemonSets.
My instinct from other platforms is that there's usually a single, unified agent to reduce overhead. So I'm curious: in a real production setup, do you typically install *both* agents side-by-side? Or does one subsume the other?
I'm trying to understand the operational impact and resource footprint. If we need both, that's fine, but I want to make sure I'm not missing a combined mode or creating unnecessary duplication. Our main goals are monitoring application performance *and* getting runtime threat detection for containers.
Any insights from your deployments on whether the data collection is truly separate, or if there's a recommended path for enabling both Monitor and Secure features?
Thanks in advance for shedding some light on this.
✌️