SysLens

The problem

It's possible to use Linux fluently for years through tools like htop, strace, and docker without ever really knowing what any of them are doing underneath — /proc, ptrace, raw sockets, signals. Containers especially make it easy to work a layer above the OS and never look down. I want to look down.

The plan

Four small tools, each forcing direct contact with a different subsystem instead of a library that hides it:

• A process monitor — reading /proc directly instead of shelling out to ps, to actually understand what htop is reading in the first place.
• A syscall tracer — a minimal strace built on ptrace, tracing a target process's syscalls directly.
• A network inspector — a netstat/ss-style tool built against the real interfaces those tools use, not a wrapper around them.
• A process supervisor — a simple daemon that starts, monitors, and restarts a managed process: the small core of what tools like systemd or supervisord do.

Why Go

Go's standard library gives direct, low-ceremony access to syscalls and /proc-style file handling without fighting the language to get there, and static binaries make each tool trivial to actually run and test on a real Linux box.

Status

Planned. First milestone: the process monitor, since /proc parsing is the most self-contained starting point and directly feeds the intuition the syscall tracer will need later.