v0.11.0 GitHub

Linux, macOS, Windows. C++20 with Qt 6. Version 0.11.0.

The HUD that follows the app you are using.

Pick any window and Crowsnest puts that app's CPU, memory, threads, file descriptors, disk and network throughput in a small panel that floats over your desktop. Click once and the same binary opens a full console for the whole machine: host, disks, GPU, sensors, containers, Kubernetes, databases, traces and what the cloud is billing you.

Install now View on GitHub
crowsnest console — Overview
Crowsnest Overview console: focused app CPU, RSS and process count tiles, CPU, memory and process count charts, host CPU, memory available and load charts, network, disk and utilisation charts, and the watchdog and forecast cards.
The compact Crowsnest overlay: focused app cursor, its PID, CPU and RSS, and one line each for Docker containers and Kubernetes pods.
And this is the overlay. 430 pixels wide, always on top, refreshed every second. Focus follows the window you are actually using.

Every panel on this page is a live capture — except the two Cloud panels, marked in the screenshot notes.

What it shows

One panel over your app. Thirty-two views behind it.

The app you are using

PID, CPU, RSS, threads, open files and context switches, added up over the app's whole process tree, not one PID. Disk read and write rates, TCP throughput and listening ports per process, sampled from the kernel once a second.

The machine under it

Host CPU and steal, memory, load, per-device disk throughput and utilisation, network interfaces, hwmon temperatures, fans and power, battery health, and GPU utilisation with the process holding it. Anything an OS cannot report is labelled as such, never left blank.

The services you run

Docker containers with live CPU, memory, network and PIDs through the Engine API. Kubernetes pods, deployments, nodes and metrics-server usage. systemd units, launchd jobs and Windows services. A local PostgreSQL client for cache hit rate, commits, deadlocks and the slowest statements.

The bills and the pager

OTLP traces, DogStatsD metrics, synthetic HTTP checks and a Prometheus endpoint on the receiving end. Cloud instance identity, accrued cost, the provider's own billed spend, the burn rate against your own trailing baseline, per-pod right-sizing with the headroom priced at your cluster's rates, and Terraform state diffed against the account listing. Alerts correlated into one incident per subject, with an owner and a page only when the rule is not flapping, SLO burn, and webhooks to the receiver you already own.

  • Local only. No account, no telemetry, no phone home. The only outbound calls are ones you switch on: cloud metadata, your own webhook, your own Prometheus scraper.
  • Honest about the gaps. A surface the OS will not give up says so on the panel. macOS TCP counters need root, Windows has no load average, the cloud inventory and the cost query are gated on an identity the host may not have, and the console prints those sentences instead of a zero. Where the instance metadata service is blocked by network policy, [cloud] identity= is a fallback — the metadata service always wins when it answers, and the page says which source it used.
  • One static binary. C++20 and Qt 6. Started from a .deb, a DMG, an MSI, an AppImage, Homebrew, Scoop or a single shell line.

Screenshots

Everything below is Crowsnest on one laptop.

A 12-core HP laptop running Linux, with three Docker containers, a local PostgreSQL, a single-node Kubernetes cluster, and local OTLP and DogStatsD clients feeding the console. Click any panel for the full frame.

Processes page: grouped process tree with CPU, memory, threads, file descriptors, per-process disk read and write rates, TCP throughput and listening ports.
Processes Each row carries CPU, RSS, threads, fds, block I/O and TCP throughput, plus the ports it listens on.
Sensors page: hottest temperature, fan RPM, power draw and battery charge tiles, hwmon readings per chip, hottest sensor and power charts, and a battery detail card.
Sensors Every hwmon chip, the battery's health and cycles, and the AC adapter state, sampled from sysfs.
GPU page: utilisation, VRAM, temperature and process count tiles, a utilisation chart, the device card and a per-process table of GPU engines and memory.
GPU Device busy, VRAM, clocks and temperature, with the processes currently using the GPU.
Network page: connection counts, established sockets, retransmit percentage and transmit throughput tiles, a throughput chart, and the connection and interface tables.
Network Sockets by state, retransmits, per-interface throughput and top talkers.
Disks page: read and write throughput, busiest device utilisation and I/O pressure tiles, a summary card, a per-device table and read, write and utilisation charts.
Disks iostat-style per-device rates, await and utilisation, plus the processes doing the writing.
Host page: host CPU, load, memory available and disk free tiles, a load chart, the host inventory summary and the platform, CPU, filesystem and network cards.
Host CPU topology, memory, load, kernel limits and every mounted filesystem with free space.
Metrics page: received, events, service checks and parse error tiles, a DogStatsD receiver card, ingestion and error charts and a series explorer table.
Metrics A DogStatsD receiver on 8125, with counters, gauges, histograms, sets, events and service checks.
Traces page: trace, span, error and service tiles, a latency chart, the service map and recent traces.
Traces An OTLP/HTTP receiver on 4318, with per-service latency, p95 and the cross-service map.
Containers page: running, issues, container count and cgroup memory tiles, a container table with CPU, memory, network and PIDs, and lifecycle buttons.
Containers Engine API stats per container — CPU, memory against the limit, I/O, PIDs — and start, stop, restart.
Kubernetes page: pod, issue, deployment and monthly cost tiles, the cluster summary, pod and deployment tables, a pods-over-time chart and the cluster health, node and event cards.
Kubernetes Pods and deployments with metrics-server usage, node capacity, warning events, deprecated APIs and cost.
Databases page: cache hit ratio, commits per second, rollbacks and deadlock tiles, a throughput chart, and the statements and application connection cards.
Databases PostgreSQL cache hit rate, commits, rollbacks, deadlocks and the slowest statements.
Logs page: log line, error, level and parse rate tiles, a journal summary, the parsed-fields card, a log volume chart, a sensitive data scan result and a tail of recent journal entries.
Logs journald, unified logging or the Windows event log, parsed into fields, scanned for secrets, and kept local.
History page: samples, span, on-disk size and interval tiles, a rewind card with a scrubber and record lines, and stored-window CPU and memory charts.
History A bounded on-disk ring of every sample, with a scrubber to rewind the console an hour.
Timeline page: event, error, warning and subject tiles, a kind and text filter, a table of events with time, severity, kind, subject and title, and a selected-event detail block.
Timeline One stream of everything that changed — alerts, actions, file edits, cluster changes — with a click from any chart spike straight to the events around it.
Cost page: monthly, hourly, CPU efficiency and memory efficiency tiles, a cost allocation card, a right-sizing card, a cost chart and namespace and workload breakdown tables.
Cost Cluster cost from declared requests, efficiency, and a per-pod suggestion table: request → usage × 1.2, priced at your own rates.
Cloud page: provider, age, accrued and monthly cost tiles, the instance identity card showing the config-fallback note, a running-instances chart, the fleet inventory table with per-instance monthly rates, and the IaC drift card reporting two resources in sync, one missing and one unmanaged.
Cloud Instance identity, the account's fleet from your own CLI with each row's age and monthly rate, and the Terraform state diffed against that listing.
Billed spend section of the Cloud page: a daily spend chart, month to date and forecast, the query it came from, and a per-service breakdown.
Billed spend What the provider actually charged this month, straight from Cost Explorer, with a month-end forecast.
Security page: exposure, findings, threats and file change tiles, the sandbox exposure card, threat rows and file integrity entries.
Security Sandbox exposure per process, log-based threat detection, and file integrity with hashes.
Settings page: version, refresh, monitors and silenced tiles, software and runtime paths, the collection scope matrix, monitor editors and the diagnostics card.
Settings Every path, every switch, which collection surfaces are live on this OS, and the monitor editors.

Notes on these captures

These are live captures of Crowsnest 0.11.0 on one machine — not mock-ups and not a designer's render. The OTLP traces, DogStatsD metrics and synthetic checks are real receiver traffic from small local test clients pointed at the HUD, and the cluster panels are a real single-node Kubernetes cluster with metrics-server. There is no cloud account behind this laptop, so the Cloud panel is a live capture against a local AWS emulator: the identity comes from [cloud] identity= (no instance metadata service exists there, and the card says so), and the instances, the rates and the Terraform diff are the emulator's real API responses decoded by the shipping code. The Billed spend close-up is the one panel rendered from the application's screenshot fixtures — a three-hour-old emulator account has one day of cost, which makes for an empty chart — so treat its numbers as a layout reference and the release notes for what is proven where.

Get started

Click your OS. Copy one line.

bash
$ curl -fsSL https://raw.githubusercontent.com/codeafridi/Crowsnest/main/install.sh | sh

Installs for your user only, puts crowsnest on PATH and starts it at login. Runs on Ubuntu, Debian, Fedora, Arch, openSUSE, Alpine and other 64 bit distros with glibc 2.34 or newer. No curl? The installer falls back to wget, busybox, or your package manager.

Prefer a package file? Download the .deb or the AppImage from Releases. The AppImage updates itself over zsync.

After install: crowsnest to run it, crowsnest status to check it, crowsnest stop to quit it, crowsnest update to upgrade.