vitals

Overview

• What: a live process and system resource monitor for Linux covering CPU, memory, I/O, network and sockets, with a TUI, a JSON mode and a rule-based alert engine.
• Hardest problem: keeping the sampler off the UI thread so its lock is held only for the hand-over, never across I/O.
• How it is validated: 36 tests plus a measurement: 15,354,540 lock acquisitions averaging 81 ns against a synthetic 3,000-process /proc.

Zero dependencies, standard library only. The lock-hold claim is measured rather than asserted.

Architecture

 /proc (CPU, memory, I/O, network, sockets)
     |
 sampler thread: pure parsers --> deltas --> ring buffer --lock (hand-over only)--> UI thread
                                      |
                           alert engine (sustain + hysteresis) --> TUI / --json output

Highlights

• 36/36 tests: 13 parser tests over /proc text (parsers are pure functions over strings), 18 delta/ring/alert-engine tests, 5 collector tests against a fabricated /proc tree, so the suite runs on Windows too.
• Off-UI-thread proof: against a synthetic 3,000-process /proc a reader made 15,354,540 lock acquisitions averaging 81 ns with a worst case of 8.5 ms during a 50.6 ms scan.
• Alerts fired against a real CPU-burning subprocess, with GONE emitted instantly on process exit and CLEARED only after hysteresis.
• pid-recycle-safe rate computation with saturating arithmetic; fixed-capacity ring buffer with zero allocation after construction.
• Options: --interval, --top, --rules FILE, --sockets, --once, --json, --duration, --proc-root DIR; JSON output validated line by line.

What I learned

Making parsers pure functions over strings meant the whole suite could run against a fabricated /proc tree, even on Windows. Measuring the lock hold time turned a design claim into a number.

Limits

No GUI, no per-socket byte attribution (that needs eBPF), and no interactive TUI keys (that would need termios).