Lightweight:
- GPU collection moves to a dedicated worker thread that owns the gfxinfo
handle for the process lifetime. gfxinfo's active_gpu() runs a full NVML
init/teardown (~20ms, blocking) and we were paying it on the async
runtime for every collect — measured at ~80% of the agent's entire
active CPU on a GPU machine. The handle holds Rc<Nvml> (not Send), so a
thread + mpsc/oneshot channel pair confines it; a zero-total-VRAM reply
is treated as a dead session (driver reload) and re-probed.
- journalctl now runs via tokio::process instead of blocking one of the
two runtime workers for the duration of the subprocess.
- TtlCell (state.rs) replaces the four hand-rolled static TTL caches; a
cached negative result now counts as fresh, so hosts with no matching
temp sensor or GPU stop rescanning every request. Single lock+clone on
the GPU cache hit path (was two).
Correctness:
- Process/child CPU times are now microseconds as documented; they were
milliseconds, rendering 1000x too small next to (correct) thread times.
- Non-Linux per-process CPU%% clamps AFTER dividing by core count; a
4-cores-busy process on an 8-core box reported 12.5% instead of 50%.
- Journal timestamps are real RFC 3339 UTC plus an additive timestamp_us
field (sorting is now numeric); the old strings were Debug-formatted
SystemTime mangled by string replace.
- Partition detection uses /sys/block on Linux: whole-disk filesystems on
names like nvme0n1 or zram1 are no longer misclassified as partitions.
One shared parent_disk_name() replaces two inline copies.
- New sampled_at_ms on the metrics payload (additive) records when the
snapshot was actually collected, so clients can compute exact rates
across the agent's TTL cache.
Security/robustness:
- key.pem is created 0600 (was umask default 0644, world-readable) and
pre-1.51 keys are tightened on startup.
- Per-PID detail/journal caches now evict (60s max age, 64 entries max);
they previously grew without bound under PID-walking clients.
- The two per-PID ws handlers collapse into one generic helper.
- /proc/<pid>/stat parsing unified in one comm-safe module.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add Debian packaging support with cargo-deb
- Add cargo-deb metadata to socktop and socktop_agent Cargo.toml
- Create systemd service file for socktop_agent
- Add postinst/postrm maintainer scripts for user/group management
- Create GitHub Actions workflow to build .deb packages for AMD64 and ARM64
- Add comprehensive documentation in docs/DEBIAN_PACKAGING.md
- Packages will be available as artifacts on every push
- Automatic GitHub releases for version tags
* Add summary documentation for debian packaging
* fix unit test, move to macro cargo_bin!
* hotfix for issue with socktop agent not creating ssl certificate on first launch after upgrade of axum server version.
* Add helpful post-install message to guide users on enabling socktop-agent service
* Fix CI build by installing libdrm development dependencies
* Fix package rename script - cargo-deb already includes architecture in filename
* Make GPU support optional to enable RISC-V builds without libdrm
- Add 'gpu' feature flag (enabled by default)
- Make gfxinfo dependency optional
- Provide no-op GPU metrics when gpu feature disabled
- Disable GPU support for RISC-V builds in CI (libdrm unavailable)
- All other architectures (amd64, arm64, armhf) still get GPU support
* feature gate GPU stats for arm v7
* specify correct package names.
* install aarch64-linux-gnu-gcc build dep
* specify correct package name
* add RISC-V GCC compiler
* add .cargo to gitignore to elimicate issue with riscv64-linux-gnu-gcc linker in config.toml
* add gcc-arm-linux-gnueabihf linker fore armv7
* set correct x-compile lib gcc-aarch64-linux-gnu for arm64 builds.
* add ports.ubuntu.com to sources
* Add ARM64 as a foreign architecture
* fixe for ARM64 build.
* security.ubuntu.com` aNNOYING
* apt repo github page
* copy output to apt repo
* fix secrets path
* fix secrets path
* change build dep
* Fix postinst message box alignment
* ci(deb): restrict APT publish to v* release tags
Previously the workflow built and published on every push to master
and feature/debian-packaging in addition to v* tags. That meant the
gh-pages APT repo got overwritten on every commit with same-version
.debs, causing apt clients to see a phantom "update available" each
time and burning ~5-10 min of cross-compile CI per merge.
After this change:
- PRs into master still cross-build .debs as a sanity check.
- v* tags build, publish to gh-pages, and create a GitHub release.
- workflow_dispatch remains as the manual escape hatch.
- master pushes no longer trigger this workflow (ci.yml still runs).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
jasonwitty
jason