5 ms·

Psdash: A linux system information web dashboard using Psutils and Flask

67 points by r4um 13y ago

nathancahill 13y ago
Use with caution. I was able to print my /etc/passwd file using /log/read.
- mhurron 13y ago
  That just means that this, like every performance dashboard, should be run internally and protected from the outside world.
- jahaja 13y ago
  Author here (and woha, didn't note that it was posted to HN. Explains the sudden github traffic.). Do you mean that you did that without actually passing /etc/passwd to as a --log arg to psdash? If so it's definitely a bug. The intent is to only allow viewing logs that was explicitly passed to psdash. And as mhurron said; it shouldn't really be public anyway.
- SEJeff 13y ago
  FYI: /etc/passwd is world readable. You get get the same info with the command: getent passwd Reading /etc/shadow is a real problem, /etc/passwd is really not a huge issue.
- arjie 13y ago
  I can do that with `cat`.
napsterbr 13y ago
Seems interesting, but I need to see some charts. I think I will use psdash + loadavg (http://loadavg.com/ http://loadavg.com/). Until now I was using New Relic server monitoring.
rmchugh 13y ago
looks interesting, will give it a try.
ams6110 13y ago
How much load do tools like this add to the system. Ideally you want monitoring tools to be like using a voltmeter on an electronic circuit... display what's happening but adding very little influence of its own.
- d0ugie 13y ago
  Virtually none in this case, though letting the processes page run on my system eats up 2% of the CPU (a long, updating list), versus 0% on everything else. Uses Flask. Do these things have a harder time pulling such figures off of VPSs?
  - ErikBjare 13y ago
    Sadly, the figure was not so conservative on my Raspberry Pi (closer to 25%).
    - jahaja 13y ago
      That's not very good. On all pages or just the process-list page? I could add an option that disables the auto-updating. The only thing that's currently polled by a background thread is some network information from /proc/net/dev.
      - ErikBjare 13y ago
        Well I incidentally only checked while on the process page (and promptly removed it), but nice work none the less.
saltyknuckles 13y ago
This is awesome
shirro 13y ago
Not picking on this tool specifically but I see these sorts of things posted on HN a bit and I am struggling to understand the appeal. So genuine quesion: I can understand it is a fun task to build but what advantages does it bring in real world use? Is it just a novelty thing or do people use these sorts of tools and if so why and what advantages do they have over ssh/cli? My sysadmin brain is always looking to reduce the dependencies and the attack surface. Ideally I want less services running on less ports. Less software to install, maintain and secure. As a result I stick to ssh and shell most of the time. Generally any admin tool that has big library dependencies (eg anything python, node.js or ruby) is on my shit list. I am a bit more sympathetic to Go because of the single static exe but otherwise I prefer plain old shell. I understand historical graphs are nice to look at and time series data is one of the areas where web tools are a win. Though I am probably more likely to look at alerts based on triggers than watch a graph in real time. I don't understand what advantage tables of process stats in html offers over the same in the cli.
- jahaja 13y ago
  I pretty much agree with you. The reason I built the tool was to give a system overview for the vagrant box we use at my work. Especially one that could tail and search logs (the one in supervisor is pretty useless). And in the end; all devs aren't devops so it's easier to have it web-based. Who knows, with time, maybe this tool can be extended to be useful for your purposes as well.
  - shirro 13y ago
    Thanks. That makes sense as a tool for developers who don't have sophisticated unix skills. I guess quite a lot of people are targeting Linux as a production environment but come from quite different backgrounds and using different platforms for development. Once you mention vagrant it all falls into place. Nice one.

67 points by r4um 13y ago

nathancahill 13y ago

Use with caution. I was able to print my /etc/passwd file using /log/read.

mhurron 13y ago
That just means that this, like every performance dashboard, should be run internally and protected from the outside world.
jahaja 13y ago
Author here (and woha, didn't note that it was posted to HN. Explains the sudden github traffic.). Do you mean that you did that without actually passing /etc/passwd to as a --log arg to psdash? If so it's definitely a bug. The intent is to only allow viewing logs that was explicitly passed to psdash. And as mhurron said; it shouldn't really be public anyway.
SEJeff 13y ago
FYI: /etc/passwd is world readable. You get get the same info with the command: getent passwd Reading /etc/shadow is a real problem, /etc/passwd is really not a huge issue.
arjie 13y ago
I can do that with `cat`.

napsterbr 13y ago

Seems interesting, but I need to see some charts. I think I will use psdash + loadavg (http://loadavg.com/ http://loadavg.com/). Until now I was using New Relic server monitoring.

rmchugh 13y ago

looks interesting, will give it a try.

ams6110 13y ago

How much load do tools like this add to the system. Ideally you want monitoring tools to be like using a voltmeter on an electronic circuit... display what's happening but adding very little influence of its own.

d0ugie 13y ago
Virtually none in this case, though letting the processes page run on my system eats up 2% of the CPU (a long, updating list), versus 0% on everything else. Uses Flask. Do these things have a harder time pulling such figures off of VPSs?
- ErikBjare 13y ago
  Sadly, the figure was not so conservative on my Raspberry Pi (closer to 25%).
  - jahaja 13y ago
    That's not very good. On all pages or just the process-list page? I could add an option that disables the auto-updating. The only thing that's currently polled by a background thread is some network information from /proc/net/dev.
    - ErikBjare 13y ago
      Well I incidentally only checked while on the process page (and promptly removed it), but nice work none the less.

saltyknuckles 13y ago

This is awesome

shirro 13y ago

Not picking on this tool specifically but I see these sorts of things posted on HN a bit and I am struggling to understand the appeal. So genuine quesion: I can understand it is a fun task to build but what advantages does it bring in real world use? Is it just a novelty thing or do people use these sorts of tools and if so why and what advantages do they have over ssh/cli? My sysadmin brain is always looking to reduce the dependencies and the attack surface. Ideally I want less services running on less ports. Less software to install, maintain and secure. As a result I stick to ssh and shell most of the time. Generally any admin tool that has big library dependencies (eg anything python, node.js or ruby) is on my shit list. I am a bit more sympathetic to Go because of the single static exe but otherwise I prefer plain old shell. I understand historical graphs are nice to look at and time series data is one of the areas where web tools are a win. Though I am probably more likely to look at alerts based on triggers than watch a graph in real time. I don't understand what advantage tables of process stats in html offers over the same in the cli.

jahaja 13y ago
I pretty much agree with you. The reason I built the tool was to give a system overview for the vagrant box we use at my work. Especially one that could tail and search logs (the one in supervisor is pretty useless). And in the end; all devs aren't devops so it's easier to have it web-based. Who knows, with time, maybe this tool can be extended to be useful for your purposes as well.
- shirro 13y ago
  Thanks. That makes sense as a tool for developers who don't have sophisticated unix skills. I guess quite a lot of people are targeting Linux as a production environment but come from quite different backgrounds and using different platforms for development. Once you mention vagrant it all falls into place. Nice one.