kernwatch
Linux kernel observability in your terminal.
Kernel diagnostics for Linux x86-64 and ARM64. Fourteen views connect tasks, scheduling, memory, I/O, cgroups and incident evidence.
Ordinary monitoring reads procfs/sysfs. Detailed latency and stack captures require explicit tracing and suitable kernel permissions.
cargo install kernwatch --lockedInstall
Linux x86-64 and ARM64; glibc and static musl builds. Choose static musl for portability and verify the published checksum.
cargo install kernwatch --lockedRequires Linux x86-64 or ARM64, Rust 1.98+ and a C linker.
git clone https://github.com/matthart1983/kernwatch.git && cd kernwatch && cargo build --release --lockedRun ./target/release/kernwatch after building, or copy it to a directory on your PATH.
The executable embeds the checked-in BPF object. A BPF-capable Clang is needed only to rebuild probe sources. Source builds use the host C library; they are not automatically static.
Quick start
Use 160 columns for the full dashboard; compact layouts work at 80×24. Source builds can be launched as ./target/release/kernwatch.
- 1Monitor the current host$
kernwatch --view dense - 2Explore without host probes or changes$
kernwatch --demo-tour - 3Replay a recorded session$
kernwatch --replay capture.kwr
Opening a tab does not start tracing. On Syscalls (6), l starts a bounded capture and x stops it. Kernel BPF permissions are required; failures remain visible. kernwatch does not elevate itself.
Navigation
| Key | View |
|---|---|
| 0 | Dense |
| 1–9 | Overview, Tasks, Scheduler, Memory, Block, Syscalls, IRQ, Cgroups, Modules |
| b | eBPF |
| m | Dmesg |
| d | Diagnose |
| F | Flame profiles |
| r | Toggle recording |
| e | Export evidence |
| q | Quit |