A single-file system telemetry collector that fits in your brain and your PATH.
There is a category of sysadmin tool that never gets enough attention: the kind that outputs exactly one line of text. Not a table, not a tree, not a dashboard—just a dense, delimited string you can grep, log, embed in a prompt, or pipe into a monitoring script without thinking twice.
probefetch.py is one of those tools. It is a 1,500-line Python script with no
external dependencies that gathers system information across Linux, macOS, BSD, and Solaris,
colors it with ANSI 256/truecolor themes, and prints it all on a single line. Written by
Jeremy Anderson and released under
the MIT license.
One line. Thirteen data points. Machine-parseable by splitting on - .
That is the entire design philosophy.
Beyond the default overview, there are seven focused modes, each producing its own independent output line. These exist because a full system overview is not always what you need. Sometimes you want to know what development tools are installed. Sometimes you need a quick security posture check. Sometimes you just want package counts.
| Flag | Purpose |
|---|---|
--devel | Languages, compilers, build tools, and package managers |
--admin | Admin panels, databases, monitoring, and web servers |
--devops | Containers, orchestration, IaC, CI/CD, and cloud CLIs |
--kernel | Kernel version, compiler, security modules, module count |
--pkgs | Installed package count per detected package manager |
--security | Firewall status, hardening tools, ASLR, kernel restrictions |
--net | Interfaces, IPs, gateway, DNS, TCP connection counts |
Each mode probes only what is relevant. --security checks UFW status from
/etc/ufw/ufw.conf, reads ASLR level from
/proc/sys/kernel/randomize_va_space, and detects installed tools like
Fail2Ban, Lynis, and ClamAV on your PATH. --devel runs version checks
against sixteen common development tools and reports only those found. No bloat, no
missing-tool warnings—just the facts.
One feature worth calling out separately is stealth mode, activated with
--sleuth or --stealth. When enabled, the script does not spawn
a single subprocess. Every piece of information is gathered by reading files directly
from /proc, /sys, and /etc.
This makes it safe to run inside container images, chroot environments, build systems with restricted execution policies, and production machines where shell-command auditing is enforced.
In stealth mode you still get hostname, OS, distro, CPU (from
/proc/cpuinfo), GPU (from /sys/bus/pci/devices), uptime (from
/proc/uptime), memory (from /proc/meminfo), and more. What
drops out are the things that inherently need a process—tool version checks,
process counts, and network IP lookups.
Terminal color support is auto-detected by inspecting $COLORTERM and
$TERM. If your terminal advertises truecolor, you get 24-bit RGB. If it
supports 256 colors, the palette is mapped to the nearest cube index. If neither, colors
are disabled entirely.
Eight themes are built in: auto dark light solarized dracula gruvbox nord mono
The mono theme uses bold and dim escapes only, with no color at all—useful
when you want emphasis without chromatic noise. And when stdout is not a TTY (piped to a
file, grep, or another program), all ANSI codes are suppressed automatically.
Two details in the implementation are worth mentioning because they address common pitfalls in system information tools.
Memory. On Linux kernels 3.14 and later, the script reads
MemAvailable from /proc/meminfo instead of estimating available
memory by subtracting MemFree, Buffers, and Cached
from MemTotal. The kernel's MemAvailable accounts for
page cache that can be reclaimed without swapping, giving a much more accurate picture of
how much memory is actually free for new applications. The older formula is retained as a
fallback for pre-3.14 kernels.
Disk. On Linux, the script filters df output to include
only physical block devices—matching paths like /dev/sd*,
/dev/nvme*, /dev/vd*, /dev/md*, and a handful of
others. Loop devices (used heavily by snap packages and ISO mounts), network mounts
(NFS, CIFS), tmpfs, and other virtual filesystems are excluded. Without this filter, a
system with several snap packages could report significantly inflated disk totals.
The script handles more than just "Linux and macOS." CPU detection alone covers eleven
architectures: x86, ARM (v6, v7, and bare), Alpha, IA-64, MIPS, PA-RISC, PowerPC,
S/390, SH, and SPARC. Each architecture reads different fields from
/proc/cpuinfo and formats the output accordingly.
Linux distribution detection works through four layers of fallback:
/etc/os-release, /usr/lib/os-release (for chroots and
containers), a table of sixty-plus release-file fingerprints, and finally
/etc/issue as a last resort. Distro families like Red Hat, SUSE, and Debian
have additional content-parsing logic to correctly identify derivatives (Rocky, Alma,
SLES, Raspbian, and so on).
# Copy the file, make it executable, run it
chmod +x probefetch.py
./probefetch.py
# Special modes
./probefetch.py --devel
./probefetch.py --security
./probefetch.py --net
# Stealth mode for containers or audited environments
./probefetch.py --sleuth --theme=nord
# Selective output
./probefetch.py hostname cpu memory
# Pipe-friendly (colors auto-disabled)
./probefetch.py | grep -oP 'Memory Usage: \K.*'
No installation step. There is no pip install, no
virtual environment, no build system. The script uses only the Python standard library.
Copy it to any machine with Python 3.8 or later and it works.
/etc/update-motd.d/90-probefetch and every SSH session starts with a system
overview.
probefetch.py --sleuth --theme=mono
on a cron schedule and append to a log file for historical tracking.
--sleuth to verify
container environment properties without installing any additional packages inside the
image.
--security gives you a one-line security
posture summary. --admin tells you what infrastructure software is present.
--devops answers "what DevOps tooling is on this box?"
This is not a replacement for neofetch, fastfetch,
hwinfo, or any full system profiler. Those tools produce rich, multi-line
output with logos, progress bars, and detailed breakdowns. This script produces one line.
That specificity is the point.
It is also not a monitoring agent. It does not push metrics anywhere or maintain state
between invocations. It is a point-in-time snapshot tool. Think of it as a more
opinionated, more colorful, more portable sibling of uname -a.
The source is a single Python file, licensed under the MIT license and maintained by Jeremy Anderson. Download it, read it, modify it, ship it with your infrastructure code, or embed it in your dotfiles repo. There is nothing else to install.
Source: git.dcos.net/dcosnet/probefetch