Noureddine RAMDI / socktop: a request-driven Rust remote system monitor with near-zero idle CPU

Created Sat, 23 May 2026 20:41:14 +0000 Modified Sat, 23 May 2026 20:41:27 +0000
945 Words
github-stars rust system-monitor tui websocket linux embedded

jasonwitty/socktop

socktop is a remote system monitoring tool built in Rust that takes a different approach to collecting system metrics. Instead of continuously polling system data in the background, its lightweight agent only gathers metrics on demand, driven by requests from a client TUI over WebSocket. This design delivers near-zero CPU usage when idle, an appealing feature for anyone monitoring resource-constrained devices like Raspberry Pis.

Architecture and core functionality of socktop

socktop consists of two Rust binaries: an agent running remotely on the target machine, and a local interactive client presenting metric data in a terminal user interface (TUI). The agent acts as a small WebSocket server. It doesn’t sample system metrics continuously but waits for requests from the client to collect and send data. This request-driven model means the agent consumes virtually no CPU when idle.

The agent uses the Rust sysinfo crate alongside direct /proc filesystem reads to obtain system metrics. It supports gathering CPU usage sparklines, memory and swap gauges, disk utilization, per-interface network throughput, temperature sensors, and optional GPU metrics. It also provides a sortable table of the top 50 processes by resource usage, with sorting triggered by user interaction.

On the client side, socktop employs Ratatui, a Rust TUI library, to render these metrics in a responsive terminal dashboard. The client connects to the agent over WebSocket (ws or wss with optional TLS), requesting updated metrics at intervals optimized for each data type (e.g., every 500ms for fast CPU stats, 2 seconds for process info, 5 seconds for disks).

Profiles for connection settings including TLS certificates can be saved, simplifying repeated monitoring of multiple hosts. There’s also a demo mode that launches a temporary local agent instance, useful for exploring features without a remote setup.

Design strengths, tradeoffs, and code quality

The standout feature of socktop is its request-driven agent design. Unlike traditional monitoring agents like Netdata or Telegraf that continuously sample and push metrics, socktop’s agent sits idle until the client asks for data. On a Raspberry Pi 4 running kernel 6.6 or higher, this approach yields CPU usage around 0.2% under continuous polling, dropping to zero when idle. This is a significant reduction in resource footprint compared to many existing agents.

Using WebSocket with JSON for communication is a straightforward choice that simplifies data exchange and allows for optional TLS encryption with self-signed certificates. While JSON isn’t the most bandwidth-efficient format, it’s human-readable and easy to debug, fitting the tool’s low-complexity, hands-on use case.

The TUI client built with Ratatui is responsive and interactive, supporting sorting by clicking on process columns, which improves usability over static monitors. The codebase, being in Rust, benefits from strong type safety and performance. The agent avoids background sampling loops, which reduces complexity and potential race conditions.

The tradeoff here is that real-time metrics depend on the client’s polling frequency and network round-trips. This might introduce latency or slight staleness compared to continuously streaming metrics. Also, the focus on Linux and reliance on /proc means socktop doesn’t support other OSes out of the box.

Cross-compilation support is thoughtfully documented, enabling users to build the agent for ARM devices like Raspberry Pi from more powerful hosts. This is a practical plus for deploying in embedded or edge environments.

Quick start with socktop

The README provides clear instructions to get started:

  • Clone and build the project:
git clone https://github.com/jasonwitty/socktop.git
cd socktop
cargo build --release
  • Run the agent on the target machine (default port 3000):
./target/release/socktop_agent --port 3000
  • Connect with the TUI client from your local machine:
./target/release/socktop ws://REMOTE_HOST:3000/ws

For Raspberry Pi and similar devices, the README notes the importance of updating to kernel 6.6+ for optimal CPU efficiency. It also suggests installing GPU-related dependencies if GPU metrics are desired:

sudo apt-get update
sudo apt-get install libdrm-dev libdrm-amdgpu1

Cross-compilation instructions are available to build ARM binaries from other platforms, which is useful if you don’t want to compile directly on the target device.

Verdict

socktop is a practical, Rust-based remote system monitor that excels in delivering near-zero CPU overhead on idle devices through its request-driven agent design. It’s an interesting alternative to more traditional monitoring stacks that rely on continuous background sampling.

Its Linux focus and /proc dependency limit its platform reach, but for Linux users, especially those monitoring resource-constrained or embedded systems, socktop offers a clean, efficient tool with a modern Rust codebase and an interactive terminal UI.

If you want a remote monitor that minimizes resource impact and you don’t need the full feature set or continuous streaming of heavier agents, socktop is worth a look. The tradeoff in polling latency and limited OS support is clear, but the code quality and thoughtful design make this a solid option in the Rust system monitoring space.

→ GitHub Repo: jasonwitty/socktop ⭐ 163 · Rust