+1 for anything by Brendan Gregg.

I wasn't aware of the polling limitations of sysdig, but it definitely explains some things I've seen in the past. This is definitely going in my toolkit. Cheers!

Edit: dammit, spelled his name wrong.