It was fine, then it wasn’t, then someone rebooted it.
Hostmortem keeps the minutes before.
A recorder for Linux gateways and edge boxes. It writes kernel, network and service evidence to disk, survives the reboot, and answers with what it knows, what it suspects and what it could not see.
Move along the tape, or focus it and use the arrow keys, to read each recorded event.
How it records
-
Watches five places
procfs counters, link and route changes over rtnetlink, the kernel log, a few active probes, and the processes you name.
-
Writes evidence, not dashboards
One writer commits batches to SQLite in WAL mode. If something is dropped under load, the drop itself is written down.
-
Orders time it can trust
Boot order first, then the kernel’s boot clock. Wall time is only for display, because edge boxes often wake up in 1970.
-
Argues with itself
Twelve playbooks score evidence for and against. If two explanations tie or nothing qualifies, the answer is “unknown”.
Measured, with the script that measured it
Measured in an Ubuntu 24.04 arm64 container on an Apple M1 Pro (Colima VM, 4 vCPU). Not a Raspberry Pi; Pi numbers come later.
Where it stands
Working
Not yet
C++20, SQLite, Linux interfaces only. The source is private while v0.1 settles; this page and its repository explain the build. Every incident above comes from the lab’s own output files, unedited apart from shortening.