sysmon-gov
A real-time terminal dashboard for LEMP and WordPress servers. Tells you what a box is actually doing in the five seconds after you SSH in.
Highlights
- Log analyzer that reads nginx access logs GoAccess-style, then flags attack signatures and POST floods before they turn into an outage
- SYN flood detection that still works once SYN cookies kick in, by reading `ss -tn state syn-recv` instead of the /proc/net/tcp trick that goes blind
- Parallel collection across goroutines with a shared log reader, so it refreshes live without setting the CPU on fire
- Clipboard copy that survives SSH, using OSC 52 with a fallback for terminals that do not support it
- One TOML config with environment presets, so the same binary behaves on a shared box and a dedicated one
When a server starts misbehaving, the honest version of troubleshooting is
that you SSH in and start guessing. top in one pane, tail -f on the access
log in another, ss for the connections, a mysqladmin here, and a lot of
squinting while you build the picture in your head. sysmon-gov puts that whole
picture on one screen, so you get to the answer before the client emails again.
What it is
A real-time terminal dashboard written in Go on top of tview. I built it for the exact boxes I look after, the LEMP and WordPress stacks, so it already knows where nginx keeps its logs and that the database is probably MariaDB rather than MySQL. That opinionated part is the point. It is not a generic metrics tool you have to configure into usefulness. It shows up knowing the job.
What it watches
CPU, memory, disk and load, the usual vitals. On top of that it parses the
nginx access logs live, reads the MariaDB process list, watches Redis, and
pulls per-process resource use straight from /proc. It refreshes fast enough
to feel live without becoming the thing that is loading the server, which took
more care than I expected.
The parts I am proud of
The log analyzer (press A) reads access logs the way GoAccess does, then
keeps going. It flags known attack signatures and tracks POST floods, which is
usually the shape a WordPress login or xmlrpc attack takes in the minutes
before it becomes an outage. Seeing it early is most of the battle.
The SYN flood detection actually works on a modern kernel. Nearly every
script online reads /proc/net/tcp and counts half-open sockets, but that view
goes blind the moment SYN cookies engage, which is precisely when you have a
flood worth detecting. sysmon-gov reads ss -tn state syn-recv instead, so it
still sees the attack when it matters.
Under the hood, collection runs in parallel across goroutines coordinated by a
WaitGroup, and shares a single log reader rather than opening the same file
five times. A two-speed collector separates the cheap metrics from the
expensive ones so nothing waits on the slowest query. Small decisions, but they
add up to a dashboard that stays out of the way.
Why it exists
I got tired of assembling the same mental picture by hand at 2am. It started as a tool for me and turned into something I would hand another admin without apologising for it. It lives on GitHub, and there is a rough plan for a hosted version, but at its core it is just the tool I wish I had ten years ago.