Process Table	Alert List / Tree (placeholder)

Screenshots are placeholders – replace images in docs/ with real captures (screenshot_process_list.png, screenshot_alerts.png).

This project provides a minimal yet extensible stack for distributed process monitoring:

• Go Agent: periodically samples local process metadata & metrics using gopsutil.
• Go Server: receives batches, evaluates alert rules, offers REST & Prometheus endpoints, optional PostgreSQL persistence.
• React Web UI: lists processes, active alerts; (charts & advanced UX are extension points).
• Docker / Compose: single‑command sandbox deployment.

Target use cases: lightweight capacity insight, anomaly detection (runaway CPU / memory), baseline for custom SRE tooling, or educational reference architecture.

Current capabilities (✔ implemented / 🔧 partial / 🚧 planned):

Agent (gopsutil) --> batched JSON --> Server (ingest)
																			|-- In-memory ring buffer
																			|-- PostgreSQL (optional)
																			|-- Alert Engine (rules, window eval)
																			|-- REST API /metrics
																						|-- Web UI (React)
																						|-- Prometheus / Grafana

Data path: Agent collects → sends batch → Server buffers & optionally persists → scheduled evaluation updates alerts → consumers query snapshots, history, or aggregated series.

docker compose up --build

Services:

• API: http://localhost:8080
• UI: http://localhost:3000

Test:

curl 'http://localhost:8080/api/v1/processes?agent_id=agent1'

cd backend
go run ./cmd/server -config ../server.yaml

Separate terminal:

cd backend
go run ./cmd/agent -config ../agent.yaml

cd web
npm install
npm run dev

Configure a dev proxy or change fetch base to reach :8080.

agent.yaml

agent_id: agent1
server_url: http://server:8080
interval: 5s

server.yaml

bind_addr: :8080
retention: 1h
eval_interval: 15s
max_snapshots: 7200
persistence: false
db_dsn: postgres://user:pass@postgres:5432/procmon?sslmode=disable

curl -X POST http://localhost:8080/api/v1/agents/agent1/processes \
	-H 'Content-Type: application/json' \
	-d '{"agent_id":"agent1","interval_s":5,"samples":[{"pid":1234,"ppid":1,"name":"demo","cmdline":"/usr/bin/demo","username":"root","status":"R","cpu_percent":12.5,"memory_rss":2048000,"memory_percent":0.4,"num_threads":5}]}'

curl 'http://localhost:8080/api/v1/processes?agent_id=agent1&cpu_gt=50'

curl -X POST http://localhost:8080/api/v1/alert-rules \
	-H 'Content-Type: application/json' \
	-d '{"id":"rule_high_cpu","name":"High CPU","metric":"cpu_percent","operator":">","threshold":80,"duration":"60s","enabled":true}'

curl 'http://localhost:8080/api/v1/processes/1234/series?agent_id=agent1&step=15s&from=$(date -u -d "5 min ago" +%Y-%m-%dT%H:%M:%SZ)'

{
	"id": "rule_high_cpu",
	"name": "High CPU",
	"process_name": "",         
	"pid": 1234,                 
	"metric": "cpu_percent",    
	"operator": ">",             
	"threshold": 80,
	"duration": "60s",
	"enabled": true
}

Returns averaged bucket points; empty buckets omitted.

• max_snapshots bounds memory (ring buffer). Reduce for very high scrape rates.
• CPU percent depends on sampling cadence; dual-sample improvement optional.
• Series endpoint intentionally simple—integrate TSDB for richer queries.
• Avoid high-cardinality Prometheus labels (per-PID) unless filtered.

1. Query endpoint for persisted alert events.
2. PID start/exit event stream & webhook.
3. UI charts & rule management views.
4. Advanced rule types (rate, absence, zombie detection).
5. Multi-tenant + auth.

MIT (add LICENSE before publishing publicly).

Chinese version: see README.zh-CN.md.