probefetch/blog.html

394 lines
14 KiB
HTML

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>probefetch v5.0 &mdash; A Single-File System Telemetry Collector</title>
<style>
:root {
--bg: #0d1117;
--surface: #161b22;
--border: #30363d;
--text: #e6edf3;
--muted: #8b949e;
--accent: #58a6ff;
--code-bg: #1c2128;
--green: #3fb950;
--orange: #d29922;
}
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
background: var(--bg);
color: var(--text);
line-height: 1.7;
max-width: 780px;
margin: 0 auto;
padding: 2rem 1.5rem 4rem;
}
h1 {
font-size: 2rem;
font-weight: 700;
margin-bottom: 0.25rem;
letter-spacing: -0.02em;
}
.subtitle {
color: var(--muted);
font-size: 1.05rem;
margin-bottom: 2.5rem;
}
h2 {
font-size: 1.35rem;
font-weight: 600;
margin-top: 2.5rem;
margin-bottom: 0.75rem;
padding-bottom: 0.35rem;
border-bottom: 1px solid var(--border);
}
p { margin-bottom: 1rem; }
a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }
pre {
background: var(--code-bg);
border: 1px solid var(--border);
border-radius: 6px;
padding: 1rem 1.25rem;
overflow-x: auto;
margin-bottom: 1.25rem;
font-size: 0.875rem;
line-height: 1.55;
}
code {
font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
font-size: 0.875em;
}
p code, li code {
background: var(--code-bg);
padding: 0.15em 0.4em;
border-radius: 4px;
border: 1px solid var(--border);
}
ul, ol { margin-bottom: 1rem; padding-left: 1.5rem; }
li { margin-bottom: 0.4rem; }
.callout {
background: var(--surface);
border-left: 3px solid var(--accent);
padding: 0.85rem 1.1rem;
border-radius: 0 6px 6px 0;
margin-bottom: 1.25rem;
}
.callout p { margin-bottom: 0; }
.callout.green { border-left-color: var(--green); }
.callout.orange { border-left-color: var(--orange); }
table {
width: 100%;
border-collapse: collapse;
margin-bottom: 1.25rem;
font-size: 0.925rem;
}
th, td {
text-align: left;
padding: 0.55rem 0.75rem;
border-bottom: 1px solid var(--border);
}
th { color: var(--muted); font-weight: 600; font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.04em; }
.tag {
display: inline-block;
background: var(--surface);
border: 1px solid var(--border);
border-radius: 12px;
padding: 0.15em 0.6em;
font-size: 0.8rem;
color: var(--muted);
margin-right: 0.3rem;
}
.tag.green { color: var(--green); border-color: var(--green); }
.meta {
color: var(--muted);
font-size: 0.85rem;
margin-bottom: 2rem;
}
.meta span { margin-right: 1rem; }
.demo-output {
font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
font-size: 0.8rem;
background: var(--code-bg);
border: 1px solid var(--border);
border-radius: 6px;
padding: 1rem 1.25rem;
margin-bottom: 1.25rem;
white-space: pre-wrap;
word-break: break-all;
color: var(--muted);
line-height: 1.6;
}
.footer {
margin-top: 3rem;
padding-top: 1.5rem;
border-top: 1px solid var(--border);
color: var(--muted);
font-size: 0.85rem;
}
</style>
</head>
<body>
<h1>probefetch v5.0</h1>
<p class="subtitle">A single-file system telemetry collector that fits in your brain and your PATH.</p>
<div class="meta">
<span>July 2026</span>
<span>MIT License</span>
<span>Python 3.8+</span>
<span>Zero dependencies</span>
</div>
<p>
There is a category of sysadmin tool that never gets enough attention: the kind that
outputs exactly one line of text. Not a table, not a tree, not a dashboard&mdash;just a
dense, delimited string you can grep, log, embed in a prompt, or pipe into a monitoring
script without thinking twice.
</p>
<p>
<code>probefetch.py</code> is one of those tools. It is a 1,500-line Python script with no
external dependencies that gathers system information across Linux, macOS, BSD, and Solaris,
colors it with ANSI 256/truecolor themes, and prints it all on a single line. Written by
<a href="https://git.dcos.net/dcosnet/probefetch">Jeremy Anderson</a> and released under
the MIT license.
</p>
<h2>What it looks like</h2>
<div class="demo-output">Host: atlas - OS: Linux 6.8.0/x86_64 - Distro: Ubuntu 24.04 - CPU: 8 x AMD Ryzen 7 5800X (3700.00 MHz) - GPU: NVIDIA GeForce RTX 3070 8192MB (5888 CUDA cores) - Processes: 312 - Uptime: 14d 6h 32m - Users: 1 - Load Average: 0.83 - Memory Usage: 7842.50MB/16384.00MB (47.86%) - Disk Usage: 186.42GB/512.00GB (36.41%)</div>
<p>
One line. Thirteen data points. Machine-parseable by splitting on <code> - </code>.
That is the entire design philosophy.
</p>
<h2>Seven special modes</h2>
<p>
Beyond the default overview, there are seven focused modes, each producing its own
independent output line. These exist because a full system overview is not always what
you need. Sometimes you want to know what development tools are installed. Sometimes you
need a quick security posture check. Sometimes you just want package counts.
</p>
<table>
<thead>
<tr><th>Flag</th><th>Purpose</th></tr>
</thead>
<tbody>
<tr><td><code>--devel</code></td><td>Languages, compilers, build tools, and package managers</td></tr>
<tr><td><code>--admin</code></td><td>Admin panels, databases, monitoring, and web servers</td></tr>
<tr><td><code>--devops</code></td><td>Containers, orchestration, IaC, CI/CD, and cloud CLIs</td></tr>
<tr><td><code>--kernel</code></td><td>Kernel version, compiler, security modules, module count</td></tr>
<tr><td><code>--pkgs</code></td><td>Installed package count per detected package manager</td></tr>
<tr><td><code>--security</code></td><td>Firewall status, hardening tools, ASLR, kernel restrictions</td></tr>
<tr><td><code>--net</code></td><td>Interfaces, IPs, gateway, DNS, TCP connection counts</td></tr>
</tbody>
</table>
<p>
Each mode probes only what is relevant. <code>--security</code> checks UFW status from
<code>/etc/ufw/ufw.conf</code>, reads ASLR level from
<code>/proc/sys/kernel/randomize_va_space</code>, and detects installed tools like
Fail2Ban, Lynis, and ClamAV on your PATH. <code>--devel</code> runs version checks
against sixteen common development tools and reports only those found. No bloat, no
missing-tool warnings&mdash;just the facts.
</p>
<h2>Stealth mode</h2>
<p>
One feature worth calling out separately is stealth mode, activated with
<code>--sleuth</code> or <code>--stealth</code>. When enabled, the script does not spawn
a single subprocess. Every piece of information is gathered by reading files directly
from <code>/proc</code>, <code>/sys</code>, and <code>/etc</code>.
</p>
<div class="callout green">
<p>
This makes it safe to run inside container images, chroot environments, build systems
with restricted execution policies, and production machines where shell-command auditing
is enforced.
</p>
</div>
<p>
In stealth mode you still get hostname, OS, distro, CPU (from
<code>/proc/cpuinfo</code>), GPU (from <code>/sys/bus/pci/devices</code>), uptime (from
<code>/proc/uptime</code>), memory (from <code>/proc/meminfo</code>), and more. What
drops out are the things that inherently need a process&mdash;tool version checks,
process counts, and network IP lookups.
</p>
<h2>Color themes</h2>
<p>
Terminal color support is auto-detected by inspecting <code>$COLORTERM</code> and
<code>$TERM</code>. If your terminal advertises truecolor, you get 24-bit RGB. If it
supports 256 colors, the palette is mapped to the nearest cube index. If neither, colors
are disabled entirely.
</p>
<p>
Eight themes are built in:
<span class="tag">auto</span>
<span class="tag">dark</span>
<span class="tag">light</span>
<span class="tag">solarized</span>
<span class="tag">dracula</span>
<span class="tag">gruvbox</span>
<span class="tag">nord</span>
<span class="tag green">mono</span>
</p>
<p>
The <code>mono</code> theme uses bold and dim escapes only, with no color at all&mdash;useful
when you want emphasis without chromatic noise. And when stdout is not a TTY (piped to a
file, grep, or another program), all ANSI codes are suppressed automatically.
</p>
<h2>Accurate metrics, not naive ones</h2>
<p>
Two details in the implementation are worth mentioning because they address common
pitfalls in system information tools.
</p>
<p>
<strong>Memory.</strong> On Linux kernels 3.14 and later, the script reads
<code>MemAvailable</code> from <code>/proc/meminfo</code> instead of estimating available
memory by subtracting <code>MemFree</code>, <code>Buffers</code>, and <code>Cached</code>
from <code>MemTotal</code>. The kernel's <code>MemAvailable</code> accounts for
page cache that can be reclaimed without swapping, giving a much more accurate picture of
how much memory is actually free for new applications. The older formula is retained as a
fallback for pre-3.14 kernels.
</p>
<p>
<strong>Disk.</strong> On Linux, the script filters <code>df</code> output to include
only physical block devices&mdash;matching paths like <code>/dev/sd*</code>,
<code>/dev/nvme*</code>, <code>/dev/vd*</code>, <code>/dev/md*</code>, and a handful of
others. Loop devices (used heavily by snap packages and ISO mounts), network mounts
(NFS, CIFS), tmpfs, and other virtual filesystems are excluded. Without this filter, a
system with several snap packages could report significantly inflated disk totals.
</p>
<h2>Platform breadth</h2>
<p>
The script handles more than just "Linux and macOS." CPU detection alone covers eleven
architectures: x86, ARM (v6, v7, and bare), Alpha, IA-64, MIPS, PA-RISC, PowerPC,
S/390, SH, and SPARC. Each architecture reads different fields from
<code>/proc/cpuinfo</code> and formats the output accordingly.
</p>
<p>
Linux distribution detection works through four layers of fallback:
<code>/etc/os-release</code>, <code>/usr/lib/os-release</code> (for chroots and
containers), a table of sixty-plus release-file fingerprints, and finally
<code>/etc/issue</code> as a last resort. Distro families like Red Hat, SUSE, and Debian
have additional content-parsing logic to correctly identify derivatives (Rocky, Alma,
SLES, Raspbian, and so on).
</p>
<h2>How to use it</h2>
<pre><code># Copy the file, make it executable, run it
chmod +x probefetch.py
./probefetch.py
# Special modes
./probefetch.py --devel
./probefetch.py --security
./probefetch.py --net
# Stealth mode for containers or audited environments
./probefetch.py --sleuth --theme=nord
# Selective output
./probefetch.py hostname cpu memory
# Pipe-friendly (colors auto-disabled)
./probefetch.py | grep -oP 'Memory Usage: \K.*'</code></pre>
<div class="callout orange">
<p>
<strong>No installation step.</strong> There is no <code>pip install</code>, no
virtual environment, no build system. The script uses only the Python standard library.
Copy it to any machine with Python 3.8 or later and it works.
</p>
</div>
<h2>Real-world use cases</h2>
<ul>
<li>
<strong>MOTD / login banner.</strong> Add a one-liner to
<code>/etc/update-motd.d/90-probefetch</code> and every SSH session starts with a system
overview.
</li>
<li>
<strong>Cron-based logging.</strong> Run <code>probefetch.py --sleuth --theme=mono</code>
on a cron schedule and append to a log file for historical tracking.
</li>
<li>
<strong>Shell prompts.</strong> Embed a selective output in your PS1 or starship prompt
for at-a-glance system context in every terminal.
</li>
<li>
<strong>Inventory scripts.</strong> Pipe output into a central collector to build a
lightweight asset inventory without deploying an agent.
</li>
<li>
<strong>Container health checks.</strong> Use <code>--sleuth</code> to verify
container environment properties without installing any additional packages inside the
image.
</li>
<li>
<strong>Quick audits.</strong> <code>--security</code> gives you a one-line security
posture summary. <code>--admin</code> tells you what infrastructure software is present.
<code>--devops</code> answers "what DevOps tooling is on this box?"
</li>
</ul>
<h2>What it is not</h2>
<p>
This is not a replacement for <code>neofetch</code>, <code>fastfetch</code>,
<code>hwinfo</code>, or any full system profiler. Those tools produce rich, multi-line
output with logos, progress bars, and detailed breakdowns. This script produces one line.
That specificity is the point.
</p>
<p>
It is also not a monitoring agent. It does not push metrics anywhere or maintain state
between invocations. It is a point-in-time snapshot tool. Think of it as a more
opinionated, more colorful, more portable sibling of <code>uname -a</code>.
</p>
<h2>Get it</h2>
<p>
The source is a single Python file, licensed under the MIT license and maintained by
Jeremy Anderson. Download it, read it, modify it, ship it with your infrastructure code,
or embed it in your dotfiles repo. There is nothing else to install.
</p>
<p>
<strong>Source:</strong>
<a href="https://git.dcos.net/dcosnet/probefetch">git.dcos.net/dcosnet/probefetch</a>
</p>
<div class="footer">
<p>
Based on sysinfo.pl by David Rudie, Travis Morgan, and Nils Goers.
Rewritten in Python as <strong>probefetch</strong> by Jeremy Anderson with expanded
platform support, color themes, stealth mode, and additional special modes.
Licensed under the MIT License.
</p>
</div>
</body>
</html>