SysWatch: a system monitor that remembers the last ten minutes

What's happening, and why, before you open anything else

The pitch is aimed at a specific pain: most terminal monitors show what is happening right now, while the question you actually have is why something spiked four minutes ago. SysWatch keeps the last ten minutes of every subsystem and answers the why in plain English, before you reach for the process viewer, the IO statistics tool, the network monitor, the power metrics utility and a notebook of one-liners.

It is the third tool in a family, sibling to a network-focused NetWatch and a disk-focused DiskWatch, sharing the same chrome and palette, which means the interface conventions you learn once carry across the set. The default view is a twelve-tab tour, one tab per subsystem, opened by running the bare command with no flags.

The claim that separates it from the crowded system-monitor field is the anomaly card: where a threshold monitor reports that CPU crossed ninety percent, this reports the process responsible, in a sentence. That is a diagnostic claim rather than a display claim, and it is the part worth testing on your own noisy workloads.

Twelve tabs, each with the tools it replaces

The tab table doubles as a consolidation map, naming the classic tool each tab replaces: overview as a dashboard across subsystems; CPU standing in for the usual process-viewer CPU panel and per-processor statistics; memory for the free-and-vm-stat family; disks for IO statistics, aggregate; filesystems for disk-free and mount listings; processes for the process tree; GPU reading the platform's accelerator statistics on both operating systems; power for the battery and power-management sources; services for the system service manager listings; net for the network monitors.

Two tabs have no equivalent, and they are the point. Timeline is a session log with a scrubber, rewinding every panel at once. Insights holds the plain-English anomaly cards. The framing sentence in the README draws the line cleanly: where the process viewer shows you what is running, this shows you what is happening, across CPU, memory, IO, GPU, power and services, and tells you why when something is anomalous.

Particular capabilities called out: per-process memory that matches the platform's own activity monitor, measured per-process bandwidth and energy. Matching the numbers the operating system's GUI shows is a quiet correctness claim that most TUI monitors quietly fail.

Install, everywhere it seems

The packaging story is unusually broad, with a repology badge tracking distribution reach:

brew install syswatch                 # macOS / Linux
nix-shell -p syswatch                 # NixOS / Nix
paru -S syswatch                      # Arch
cargo install syswatch                # anywhere with Rust

Pre-built binaries cover Linux and macOS on x86_64 and aarch64, static musl builds, and, in a flourish of dedication, a static armv5te build for old Marvell Kirkland-era NAS boxes, with a specific consumer model named as the example. A tool that ships for hardware that old has decided who its long tail is.

From source, the standard Rust path:

git clone https://github.com/matthart1983/syswatch.git && cd syswatch
cargo build --release && ./target/release/syswatch

Three run modes cover three questions:

syswatch --dense               # every subsystem on one screen
syswatch                       # the twelve-tab tour, default 1Hz tick
syswatch --lite                # the one-screen Lite view
syswatch --tick 500            # 2Hz
syswatch --tab procs           # boot straight into a tab
syswatch --replay session.swr  # scrub a recorded session
syswatch --record --keep 24h   # unattended recording, no TUI (see below)

The dense mode deserves its own section, and the lite mode is the honest opposite: the smallest useful thing, one small screen when that is the whole question, cycling between views with a single key.

The keyboard contract, and session memory

The keybindings read like a designed contract rather than an accretion:

1 2 3 4 5 6 7 8 9   →  Overview / CPU / Mem / Disks / FS / Procs / GPU / Power / Services
0 - +               →  Net / Timeline / Insights
Tab / Shift-Tab     →  Cycle tabs
↑ / ↓               →  Select row (Procs, Services)
s                   →  Cycle sort (Procs, Services)
/ or f              →  Filter the table (Procs, Memory, Services)
← / →               →  Scrub session backward / forward
Home / End          →  Oldest sample / live
p                   →  Pause
g                   →  Graph style (bars / dots)
,                   →  Settings (tick, theme, graph fade)
S / R               →  Snapshot to disk / record session
V                   →  Cycle views: Full → Lite → Dense
L                   →  Jump straight to the Lite view
?                   →  Help
q / Ctrl-C          →  Quit

Digits jump to tabs, arrows select and scrub, the slash filters tables, and the letters handle the rest: sort cycling, graph style between bars and dots, theme cycling including a terminal theme that defers to your own palette, a settings dialog for tick and fade, snapshot and record, view cycling, pause, and help.

The record and snapshot commands matter most for the tool's core promise. A session can be recorded unattended, without the interface, with a duration argument documented for day-scale capture, and a snapshot lands the current state on disk. Combined with the scrubber, the workflow is: leave it recording through the incident, then rewind to the moment and read the anomaly card.

The tick defaults to one hertz, which is the right default for a human-readable diagnostic tool, and pausing freezes the view for reading without losing the session behind it.

Dense: a full-frame answer to the wall of boxes

The dense view is the specification of a different philosophy: every subsystem on one 130-by-44-character screen, six boxes, zero chrome rows. No header, no tab bar, no status bar; identity, uptime, aggregates, sort state, page range and every keybind live inside the box borders, so a heading costs no row.

rows  0-11  cpu            full-height braille graph · axis · vitals
rows 12-23  mem  │ net     composition + history │ mirrored down/up
rows 24-31  cores │ disk   per-core grid │ read/write sparklines
rows 32-43  procs          detail-in-place + process table

Two rendering choices carry it. Braille graphs encode magnitude as colour, packing time series into dense character cells while keeping values legible. And the network panel is a mirrored pair, download growing up from a shared axis while upload grows down, turning traffic symmetry into a shape you can read at a glance, a genuinely better encoding than two independent strips.

Where lite is the smallest useful thing, dense is the largest, and the tour mode between them is the comfortable default. Cycling all three with one key makes the tool equally at home in a quick check, a full terminal, and a permanent second monitor pane.

Cadence, licence, and the alternatives

The project moves: v0.14.2 on 2026-09-14, with v0.14.1 and v0.14.0 the same week, a security policy file in the tree, Nix packaging alongside the flake, and demo tapes for the terminal recordings committed to the repository. The licence is MIT, and the last push was on 2026-09-14.

The alternatives are the tools the tab table replaces, used together with a shell history. A process viewer plus IO and network monitors plus powermetrics gives you more raw detail and none of the memory, none of the scrubbing, and none of the explanation; the classic stack answers what, instantly, and leaves why as an exercise. The commercial system monitors add graphs and retention in a windowed application at a price.

SysWatch's bet is that the missing layer in terminal diagnostics is time plus interpretation: keep ten minutes, name the culprit, and make rewinding free. For a single-host operator, that bet is cheap to test, and the breadth of the packaging means the test is one package-manager command.

Editorial conclusion

SysWatch fits operators and developers on macOS or Linux who diagnose their own machines and want the last ten minutes of every subsystem one scrub away, with plain-English cards naming the process behind an anomaly instead of a bare threshold. It does not fit remote fleet monitoring or deep single-subsystem analysis, where dedicated tools go further than a general TUI. Verify first: that the anomaly cards name sensible culprits on your noisiest workloads, that the ten-minute window covers your incident style, and whether dense or lite becomes your daily view. The licence is MIT, and the last push was on 2026-09-14.

Frequently asked questions

Official sources

1. License: MIT
2. matthart1983/syswatch on GitHub
3. Project website
4. README
5. Releases