DEV Community

Ziyad Parkar
Ziyad Parkar

Posted on

NecroLog: The Haunted Daemon — Air-Gapped Systems Telemetry & Process Archaeology

#devchallenge #hf26challenge

Hacktoberfest Open-Source AI Challenge: Ghost in the Machine Submission 👻🌼

NecroLog: The Haunted Daemon — Air-Gapped Systems Telemetry & Process Archaeology

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

NecroLog is an institutional, air-gapped system observability dashboard that brings literal meaning to the theme Ghost in the Machine.

In modern computing, operating systems are inherently steeped in spectral nomenclature: daemons running quietly in the background, zombie processes that have terminated but still linger in the process table, and orphan routines severed from their parent PID.

NecroLog interrogates this low-level systems layer using real hardware telemetry. It inspects lingering background processes, hung PIDs, anomalous thread allocations, and memory pressure, piping them directly to an on-device open-weight model. Acting as a digital archaeologist, the model performs a technical and poetic "post-mortem" on the operating system's state—diagnosing the digital echoes, abandoned threads, and legacy routines that are silently haunting your machine.

It bridges low-level POSIX systems engineering with local open-weight AI inference, packaged inside a refined, enterprise dark-mode console.

Demo

Code

How I Built It

NecroLog relies strictly on a lightweight, multi-language architecture that enforces a clean separation of concerns while avoiding heavy, bloated JavaScript toolchains:

  • Local Inference Engine & Open Weights: Powered locally by Ollama running Llama 3.2 3B Instruct (with interchangeable support for Qwen 2.5 3B / 7B). The model consumes structured telemetry vectors and is conditioned through an analytical system prompt to act as an OS diagnostician and digital archaeologist.
  • Backend (Python 3.11+ / FastAPI): Architected as a single serverless-ready Python service (api/index.py). It utilizes psutil to inspect real-time process tables, memory swap pressure, active daemon hierarchies, and zombie states, dispatching asynchronous requests to Ollama over local HTTP via httpx.
  • Frontend (Vanilla ES6+ JavaScript, HTML5, CSS3): Strictly zero TypeScript, React, or Node bundlers. The user interface lives entirely in public/ and implements an enterprise-grade dark telemetry console featuring charcoal surfaces, hairline grid borders, monospace telemetry HUDs, and real-time process indicators.
  • Deployment & Portability: Packaged with a native vercel.json configuration for one-click serverless function routing, providing immediate cloud preview capabilities alongside local bare-metal execution. 
necro-log/
├── api/
│   └── index.py            # FastAPI telemetry harvester + Ollama client + failover
├── public/
│   ├── index.html          # Enterprise dark-mode telemetry dashboard
│   ├── style.css           # Institutional design system (Inter + JetBrains Mono)
│   └── app.js              # Pure Vanilla ES6 state coordinator
├── requirements.txt        # Production Python dependencies (fastapi, psutil, httpx)
├── vercel.json             # Serverless routing & rewrites
└── README.md               # Architecture documentation & setup guide
Enter fullscreen mode Exit fullscreen mode

Why Does Open Innovation Matter?
Open innovation is not just an aesthetic choice for NecroLog—it is the only architecture that makes the project viable:
Zero Data Exfiltration for Sensitive OS Telemetry: A computer's process list contains environment variables, absolute local file system paths, application flags, user IDs, and occasionally active authentication tokens. Piping an operating system's raw process table and daemon metadata to third-party commercial cloud APIs constitutes a critical security and privacy hazard. Running open weights locally guarantees that system vitals never leave the device.
True Air-Gapped, Offline Reliability: Closed models require continuous, high-bandwidth internet connectivity. An OS health monitor must operate when the network goes down, during an air-gapped incident response, or in low-connectivity environments with the lights and Wi-Fi completely cut. Local open-weight inference executes on-device with zero network latency.
Economic Feasibility for Ambient Daemons: A background utility continuously monitoring telemetry cannot sustain the per-token pricing of commercial cloud APIs without racking up steep, recurring bills. Open-source models turn continuous background intelligence into a zero-marginal-cost feature of the local hardware.

The Spirit of It
There is an eerie realization that occurs when you execute an inspection on a laptop that has been running uninterrupted for months. You uncover abandoned worker threads spawned by forgotten Docker containers, zombie parent processes from long-closed terminal windows, and cached background routines silently consuming memory in the dark.
Seeing an open-weight model parse through genuine hung PIDs and synthesize the lineage of forgotten compute turns everyday debugging into a profound encounter with the invisible, lingering history built into our machines.

Top comments (0)