6 ms·

Show HN: Linux activity recorder

49 points by treskot 13y ago

X4 13y ago
This is quite awesome. What's your business model, or are you opensourcing it?
- treskot 13y ago
  We are charging $19 a server per month. First two servers are FREE.
  - adnam 13y ago
    That's expensive.
  - borplk 13y ago
    That's very expensive
  - sequoia 13y ago
    Is there any non-commercial vs. commercial distinction? I.E. do I pay the same price for my EC2 instance running tmux+weechat as my multinational enterprise software employer would pay for a production server?
    - treskot 13y ago
      There's no distinction as such. You pay a flat $19 per server.
Nodex 13y ago
Shame your website can't handle the load, keep's 500'ing. Better invest in some better website technology :)
naquad 13y ago
very ironically: service for monitoring shows 500 error
- X4 13y ago
  probably the HN-Effect.
- treskot 13y ago
  Apart from HN, we were doing great on reddit.com/r/sysadmin/. Crazy traffic. Unfortunately, the site couldn't handle it. Ngnix was going out of TCP handles. Arrrrrrgh, we should have done a better job in load testing. Fixed it by increasing filehandles. Give it a spin now!
nailer 13y ago
This is really good - +1 for the shell based installer and time sorting, and a level of polish that infrastructure tools often lack. I'd add (in addition to what you have now) your own procfs tools to extend some of the knowledge the older command line tools. - For a C app you care about argv[0] that top batch mode displays. But for some shell, python or perl or ruby you care about the actual script name. And for Java you care about the .jar (especially in enterprise envs). Even in your example, it's just some anonymous java process. There could be 12 'java's - I want to know whether it's our app or some Enterprise Crapware agent. - Likewise load average - for a multicore system a load average of 10 could be quite underutilized - if I remember correctly, the run queue is actually (number of logical cores) long. There's also some things you audience might not be familiar with, but would find valuable - tools like this can be a good way to show off some of this stuff. - Do you have ethtool in there? Particularly patch disconnect events. - You can also ask the switch what ports the host is connected to with a two liner LLDP/CDP thing. These kinds of things are GOLD to people that know they exist, but as you know, Unix tools aren't very discoverable - your app could help with that. - Not sure if this is relevant, but if you do monitor network stuff, try and steer users away from ifconfig, it's not maintained and will simply skip certain interfaces (eg, trading arbitrage desks used vlans on top of virtual IPs on top of bonds, these are completely invisible to ifconfig. There are problably other cases I haven't run into yet). Are you guys on Twitter? I'm also working in similar space (used to work at Red Hat and IBM as a Linux specialist, now I write node apps all day). Not competing, but doing similar stuff.
- X4 13y ago
  Good input, yeah after seeing the demo I've also noticed that the anomaly detection monitoring cannot be solved by simply pointing to a process. I'd suggest aggregating the data of vmstat,ps,lsof,nc etc. into a simplified and abstract summary by incorparating a structure based AI model, like HTM. You could build rules and action lists and anomaly type lists, then let the AI categorize anomalies by pattern and structure detection. Heck you could go much further, ie. building an NLP query interface.. Don't get me wrong, I don't want to smoke your brain, it's just what I would do. Keep working on it!
  - 13y ago
zytek 13y ago
Seems like a thing I could build in a couple of nights.. but I won't, so good to have someone who will DEDICATE themselves just for that. There are tons of stuff that can be added. Unfortunately pricetag is too high. As this is most useful when you have multiple servers then it quickly rises to hundreds of dollars per month. So I would stick with Nagios/etc. Don't want to discourage you - just my two cents.
- treskot 13y ago
  Thanks for the feedback. This is just the start, we have a lot to add. More on our roadmap here: http://blog.sealion.com/post/62987598857/why-did-we-create-sealion http://blog.sealion.com/post/62987598857/why-did-we-create-s... And yes, our target audience is users having multiple servers. You can use nagios and some other tools for logging data from few servers. Handling and debugging of logs spread across several servers is a pain in the neck.
lcasela 13y ago
"/usr/local/sealion-agent/etc/sealion: 127: ./bin/sealion-node: not found" Might want to fix that. $ curl -s https://agent.sealion.com | sudo bash /dev/stdin -o 7260187a-df41-455d-9999-9a8207257de2 Downloading agent... ############################################################ ############ 100.0% Created 'sealion' user successfully Extracting files to /usr/local/sealion-agent... Files extracted successfully Installed SeaLion as a service Starting agent... /usr/local/sealion-agent/etc/sealion: 127: ./bin/sealion- node: not found Sealion service started successfully Installation successful. Please continue on https://sealion.com
- shawabawa3 13y ago
  I got: $ curl -s https://agent.sealion.com | sudo bash /dev/stdin -o etc Downloading agent... ######################################################################## 100.0% Created 'sealion' user successfully Extracting files to /usr/local/sealion-agent... Files extracted successfully Installed SeaLion as a service Starting agent... ./bin/sealion-node: 1: Syntax error: word unexpected (expecting ")") Sealion service started successfully Installation successful. Please continue on https://sealion.com $ ./bin/sealion-node: 1: ELF: not found
  - sharkoz 13y ago
    Same here
  - simias 13y ago
    Just a wild guess but maybe the installer wants the "real" bash and you have dash set up (I think ubuntu and debian do that nowadays). That or you're missing an executable or some command returns an error that's poorly handled (since we all know proper error handling is borderline impossible in shell scripts...). That's why I don't get the point of bash scripts: if you want something truly portable you might as well use /bin/sh and if you're willing to compromise a bit of portability for more advanced features you might as well switch to perl or python (perl is probably as likely to be installed on any un*x machine as bash).
minimax 13y ago
$ curl -s https://agent.sealion.com https://agent.sealion.com | sudo bash /dev/stdin -o [UUID] Is this actually something people are willing to do? I.e. pipe from the Internet directly into a root shell? It seems especially crazy since none of the tools (ps, top, uptime, iostat, vmstat) require special privileges.
- jamespo 13y ago
  Seeing as we get a comment like this everytime one of these installers comes up, obviously yes, people are willing to do this!
  - falcolas 13y ago
    Unfortunate. It's a bad habit to get into. Random forum goer pastes something in, you're used to installing via this method, you'll execute it without thought. Boom. No longer your system.
- shawabawa3 13y ago
  To be honest, how is it any different from downloading a random executable and running it? In the end you need to basically blindly trust people if you're going to use their software (and the software needs root privileges) The only problem i have with this is that you can get MITM'd. curl doesn't validate SSL certificates
  - deweerdt 13y ago
    > curl doesn't validate SSL certificates Curl has an option to explicitly disable cert validation: -k, --insecure (SSL) This option explicitly allows curl to perform "insecure" SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. This makes all connections considered "insecure" fail unless -k, --insecure is used. Maybe you're thinking of an older version? (edited for formatting)
  - pessimizer 13y ago
    >To be honest, how is it any different from downloading a random executable and running it? It isn't, really. Both are creepy.
pbhjpbhj 13y ago
The "trusted by 30,000 companies" at the bottom of this product intro page doesn't refer to this product does it? If not then it seems a bit sleazy to me. It's great that their Yog products are widely used but they've over-stepped the line IMO. This seems more like wilful deception than a reminder that the company's other wares are widely used.
- treskot 13y ago
  Got your point. Will fix the design. Deceiving was never the intention. Just wanted to display the social proof of the parent company. BTW, did you give it a spin?
  - pbhjpbhj 13y ago
    It looks great. But I don't run any servers at the moment - I'm just an annoying stickler for the truth in marketing. Thanks for your response. FWIW I think it just needs a line like "our related Yog line of products are trusted [I'll let you have that one!] by 30,000 companies". Assuming that you can verify 30k different companies are actively using them. It's actually got a double edge too as it also tells people that you have other products in this space that will transform their daily drudge of server maintenance in to a veritable nirvana ;0)>
- gingerlime 13y ago
  Was wondering the same thing. How come a "Show HN" project is already trusted by all those many companies and big-name brands?? This didn't feel quite right.
kozhevnikov 13y ago
I got the impression that I can achieve similar (or better) results with logstash and its interval exec input [1] as well as the usual logs, events and perf counters, etc. And it has nice Kibana interface [2] on top of elasticsearch. [1] http://logstash.net/docs/1.2.1/inputs/exec http://logstash.net/docs/1.2.1/inputs/exec [2] http://www.elasticsearch.org/overview/kibana/ http://www.elasticsearch.org/overview/kibana/
samspenc 13y ago
Can I ask how this is different from ServerDensity (which we use)?
- evergre 13y ago
  I have't used ServerDensity, but on the surface it looks like Sealion is primarily focused on showing you raw output.
blahbl4hblah 13y ago
That's fantastic. Great idea and execution...
NathanKP 13y ago
I tried it out on two of my API servers and it seems to work flawlessly. I'm impressed with the beautiful style of your website. Honestly I'm not willing to pay $19 a month for more than two servers though. Maybe if it was around $5 a month per server it would be worth it. As is the price is high enough that I could take a few days of work and create and run my own logging system for all my servers and while it wouldn't have that of an pretty interface it wouldn't be costing me $400 a month.
- deleted 13y ago
  [deleted]
- treskot 13y ago
  We are glad you liked our tool :-) Point taken on pricing.
Hellenion 13y ago
SeaLion works best with the latest web browsers. It's even worse without JS, yet I'm still running a webkit browser. Please don't discriminate against unknown browsers.
- treskot 13y ago
  Sorry about that. Could you please let us know what browser you're currently using?
chrismealy 13y ago
The best part is the voice over actor in the intro video sounds like he's dubbing a kung fu movie.
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
falcolas 13y ago
OK. I was going to make this post as part of a deeper thread about installer problems, but I feel the need to post this where it will get more visibility: This script is a huge security risk. It takes arbitrary commands issued to it via the API and runs those on your system, then uploads the stdout from those commands back to their servers, where it's stored for an indeterminate amount of time with indeterminate security. (Their privacy policy makes no mention of the storage, usage, or dissemination of data collected via this tool) There is literally no limit to what commands to be run, and you can't easily audit which commands it will run prior to them being executed. There's even a built-in privilege escalation path, via the upgrade script. You might as well give them a login with passwordless sudo to any system you install this to.
- treskot 13y ago
  We wanted to make your job easy and hence provided a one-line installation command. You can always know what's happening. 1. Agent installation script is available at https://agent.sealion.com https://agent.sealion.com. Feel free to check it out. 2. We create a non-privileged user using the above script. Hence, we cannot run privileged commands without your permission. 3. The data logged is solely for your usage. The data is stored in secure Amazon servers. Will improve the privacy policy. 4. BTW, we are thinking of providing installer packages and also release the agent code under an open source license to alleviate your concerns.
  - falcolas 13y ago
    This isn't about the installer. It's about allowing arbitrary commands to be executed as specified by the API. Specifically, lib/authentication.js receives a new command, passes it to addActivity in lib/execute_services.js, which schedules it to `exec` periodically (the period is defined by the API response) via ExecuteCommand.executeCommand. As for the user that the sealion-agent is run as, it's started as root, then setuid'ed to the sealion user in index.js, so any update can undo the setuid and allow full root access. Basically, by installing sealion-agent, I have given you, all of your current employees and of your future employees (both in CA and India) full access to the server. No offense, but I don't trust you that much.
stuntmachine 13y ago
I really wish this were able to be run internally on my own server without handing these guys the keys to my castle. I'd do it in a heartbeat. Unfortunately that's not the case.

49 points by treskot 13y ago

X4 13y ago

This is quite awesome. What's your business model, or are you opensourcing it?

treskot 13y ago
We are charging $19 a server per month. First two servers are FREE.
- adnam 13y ago
  That's expensive.
- borplk 13y ago
  That's very expensive
- sequoia 13y ago
  Is there any non-commercial vs. commercial distinction? I.E. do I pay the same price for my EC2 instance running tmux+weechat as my multinational enterprise software employer would pay for a production server?
  - treskot 13y ago
    There's no distinction as such. You pay a flat $19 per server.

Nodex 13y ago

Shame your website can't handle the load, keep's 500'ing. Better invest in some better website technology :)

naquad 13y ago

very ironically: service for monitoring shows 500 error

X4 13y ago
probably the HN-Effect.
treskot 13y ago
Apart from HN, we were doing great on reddit.com/r/sysadmin/. Crazy traffic. Unfortunately, the site couldn't handle it. Ngnix was going out of TCP handles. Arrrrrrgh, we should have done a better job in load testing. Fixed it by increasing filehandles. Give it a spin now!

nailer 13y ago

This is really good - +1 for the shell based installer and time sorting, and a level of polish that infrastructure tools often lack. I'd add (in addition to what you have now) your own procfs tools to extend some of the knowledge the older command line tools. - For a C app you care about argv[0] that top batch mode displays. But for some shell, python or perl or ruby you care about the actual script name. And for Java you care about the .jar (especially in enterprise envs). Even in your example, it's just some anonymous java process. There could be 12 'java's - I want to know whether it's our app or some Enterprise Crapware agent. - Likewise load average - for a multicore system a load average of 10 could be quite underutilized - if I remember correctly, the run queue is actually (number of logical cores) long. There's also some things you audience might not be familiar with, but would find valuable - tools like this can be a good way to show off some of this stuff. - Do you have ethtool in there? Particularly patch disconnect events. - You can also ask the switch what ports the host is connected to with a two liner LLDP/CDP thing. These kinds of things are GOLD to people that know they exist, but as you know, Unix tools aren't very discoverable - your app could help with that. - Not sure if this is relevant, but if you do monitor network stuff, try and steer users away from ifconfig, it's not maintained and will simply skip certain interfaces (eg, trading arbitrage desks used vlans on top of virtual IPs on top of bonds, these are completely invisible to ifconfig. There are problably other cases I haven't run into yet). Are you guys on Twitter? I'm also working in similar space (used to work at Red Hat and IBM as a Linux specialist, now I write node apps all day). Not competing, but doing similar stuff.

X4 13y ago
Good input, yeah after seeing the demo I've also noticed that the anomaly detection monitoring cannot be solved by simply pointing to a process. I'd suggest aggregating the data of vmstat,ps,lsof,nc etc. into a simplified and abstract summary by incorparating a structure based AI model, like HTM. You could build rules and action lists and anomaly type lists, then let the AI categorize anomalies by pattern and structure detection. Heck you could go much further, ie. building an NLP query interface.. Don't get me wrong, I don't want to smoke your brain, it's just what I would do. Keep working on it!
- 13y ago

zytek 13y ago

Seems like a thing I could build in a couple of nights.. but I won't, so good to have someone who will DEDICATE themselves just for that. There are tons of stuff that can be added. Unfortunately pricetag is too high. As this is most useful when you have multiple servers then it quickly rises to hundreds of dollars per month. So I would stick with Nagios/etc. Don't want to discourage you - just my two cents.

treskot 13y ago
Thanks for the feedback. This is just the start, we have a lot to add. More on our roadmap here: http://blog.sealion.com/post/62987598857/why-did-we-create-sealion http://blog.sealion.com/post/62987598857/why-did-we-create-s... And yes, our target audience is users having multiple servers. You can use nagios and some other tools for logging data from few servers. Handling and debugging of logs spread across several servers is a pain in the neck.

lcasela 13y ago

"/usr/local/sealion-agent/etc/sealion: 127: ./bin/sealion-node: not found" Might want to fix that. $ curl -s https://agent.sealion.com | sudo bash /dev/stdin -o 7260187a-df41-455d-9999-9a8207257de2 Downloading agent... ############################################################ ############ 100.0% Created 'sealion' user successfully Extracting files to /usr/local/sealion-agent... Files extracted successfully Installed SeaLion as a service Starting agent... /usr/local/sealion-agent/etc/sealion: 127: ./bin/sealion- node: not found Sealion service started successfully Installation successful. Please continue on https://sealion.com

shawabawa3 13y ago
I got: $ curl -s https://agent.sealion.com | sudo bash /dev/stdin -o etc Downloading agent... ######################################################################## 100.0% Created 'sealion' user successfully Extracting files to /usr/local/sealion-agent... Files extracted successfully Installed SeaLion as a service Starting agent... ./bin/sealion-node: 1: Syntax error: word unexpected (expecting ")") Sealion service started successfully Installation successful. Please continue on https://sealion.com $ ./bin/sealion-node: 1: ELF: not found
- sharkoz 13y ago
  Same here
- simias 13y ago
  Just a wild guess but maybe the installer wants the "real" bash and you have dash set up (I think ubuntu and debian do that nowadays). That or you're missing an executable or some command returns an error that's poorly handled (since we all know proper error handling is borderline impossible in shell scripts...). That's why I don't get the point of bash scripts: if you want something truly portable you might as well use /bin/sh and if you're willing to compromise a bit of portability for more advanced features you might as well switch to perl or python (perl is probably as likely to be installed on any un*x machine as bash).

minimax 13y ago

$ curl -s https://agent.sealion.com https://agent.sealion.com | sudo bash /dev/stdin -o [UUID] Is this actually something people are willing to do? I.e. pipe from the Internet directly into a root shell? It seems especially crazy since none of the tools (ps, top, uptime, iostat, vmstat) require special privileges.

jamespo 13y ago
Seeing as we get a comment like this everytime one of these installers comes up, obviously yes, people are willing to do this!
- falcolas 13y ago
  Unfortunate. It's a bad habit to get into. Random forum goer pastes something in, you're used to installing via this method, you'll execute it without thought. Boom. No longer your system.
shawabawa3 13y ago
To be honest, how is it any different from downloading a random executable and running it? In the end you need to basically blindly trust people if you're going to use their software (and the software needs root privileges) The only problem i have with this is that you can get MITM'd. curl doesn't validate SSL certificates
- deweerdt 13y ago
  > curl doesn't validate SSL certificates Curl has an option to explicitly disable cert validation: -k, --insecure (SSL) This option explicitly allows curl to perform "insecure" SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. This makes all connections considered "insecure" fail unless -k, --insecure is used. Maybe you're thinking of an older version? (edited for formatting)
- pessimizer 13y ago
  >To be honest, how is it any different from downloading a random executable and running it? It isn't, really. Both are creepy.

pbhjpbhj 13y ago

The "trusted by 30,000 companies" at the bottom of this product intro page doesn't refer to this product does it? If not then it seems a bit sleazy to me. It's great that their Yog products are widely used but they've over-stepped the line IMO. This seems more like wilful deception than a reminder that the company's other wares are widely used.

treskot 13y ago
Got your point. Will fix the design. Deceiving was never the intention. Just wanted to display the social proof of the parent company. BTW, did you give it a spin?
- pbhjpbhj 13y ago
  It looks great. But I don't run any servers at the moment - I'm just an annoying stickler for the truth in marketing. Thanks for your response. FWIW I think it just needs a line like "our related Yog line of products are trusted [I'll let you have that one!] by 30,000 companies". Assuming that you can verify 30k different companies are actively using them. It's actually got a double edge too as it also tells people that you have other products in this space that will transform their daily drudge of server maintenance in to a veritable nirvana ;0)>
gingerlime 13y ago
Was wondering the same thing. How come a "Show HN" project is already trusted by all those many companies and big-name brands?? This didn't feel quite right.

kozhevnikov 13y ago

I got the impression that I can achieve similar (or better) results with logstash and its interval exec input [1] as well as the usual logs, events and perf counters, etc. And it has nice Kibana interface [2] on top of elasticsearch. [1] http://logstash.net/docs/1.2.1/inputs/exec http://logstash.net/docs/1.2.1/inputs/exec [2] http://www.elasticsearch.org/overview/kibana/ http://www.elasticsearch.org/overview/kibana/

samspenc 13y ago

Can I ask how this is different from ServerDensity (which we use)?

evergre 13y ago
I have't used ServerDensity, but on the surface it looks like Sealion is primarily focused on showing you raw output.

blahbl4hblah 13y ago

That's fantastic. Great idea and execution...

NathanKP 13y ago

I tried it out on two of my API servers and it seems to work flawlessly. I'm impressed with the beautiful style of your website. Honestly I'm not willing to pay $19 a month for more than two servers though. Maybe if it was around $5 a month per server it would be worth it. As is the price is high enough that I could take a few days of work and create and run my own logging system for all my servers and while it wouldn't have that of an pretty interface it wouldn't be costing me $400 a month.

deleted 13y ago
[deleted]
treskot 13y ago
We are glad you liked our tool :-) Point taken on pricing.

Hellenion 13y ago

SeaLion works best with the latest web browsers. It's even worse without JS, yet I'm still running a webkit browser. Please don't discriminate against unknown browsers.

treskot 13y ago
Sorry about that. Could you please let us know what browser you're currently using?

chrismealy 13y ago

The best part is the voice over actor in the intro video sounds like he's dubbing a kung fu movie.

deleted 13y ago

[deleted]

deleted 13y ago

[deleted]

falcolas 13y ago

OK. I was going to make this post as part of a deeper thread about installer problems, but I feel the need to post this where it will get more visibility: This script is a huge security risk. It takes arbitrary commands issued to it via the API and runs those on your system, then uploads the stdout from those commands back to their servers, where it's stored for an indeterminate amount of time with indeterminate security. (Their privacy policy makes no mention of the storage, usage, or dissemination of data collected via this tool) There is literally no limit to what commands to be run, and you can't easily audit which commands it will run prior to them being executed. There's even a built-in privilege escalation path, via the upgrade script. You might as well give them a login with passwordless sudo to any system you install this to.

treskot 13y ago
We wanted to make your job easy and hence provided a one-line installation command. You can always know what's happening. 1. Agent installation script is available at https://agent.sealion.com https://agent.sealion.com. Feel free to check it out. 2. We create a non-privileged user using the above script. Hence, we cannot run privileged commands without your permission. 3. The data logged is solely for your usage. The data is stored in secure Amazon servers. Will improve the privacy policy. 4. BTW, we are thinking of providing installer packages and also release the agent code under an open source license to alleviate your concerns.
- falcolas 13y ago
  This isn't about the installer. It's about allowing arbitrary commands to be executed as specified by the API. Specifically, lib/authentication.js receives a new command, passes it to addActivity in lib/execute_services.js, which schedules it to `exec` periodically (the period is defined by the API response) via ExecuteCommand.executeCommand. As for the user that the sealion-agent is run as, it's started as root, then setuid'ed to the sealion user in index.js, so any update can undo the setuid and allow full root access. Basically, by installing sealion-agent, I have given you, all of your current employees and of your future employees (both in CA and India) full access to the server. No offense, but I don't trust you that much.

stuntmachine 13y ago

I really wish this were able to be run internally on my own server without handing these guys the keys to my castle. I'd do it in a heartbeat. Unfortunately that's not the case.