Observer 0.25.0

Observer 0.25.0.

Network traffic monitoring

The dashboard now shows network traffic. Each network interface appears as two rows in the Usage panel: bytes received per second and bytes sent per second, with the interface name in parentheses.

Windows. The collector uses the system's NetworkInterface API and filters out virtual adapters, filter drivers, and the loopback interface. The loopback interface is filtered because its traffic is internal to the machine and does not represent real network activity.

Linux. The collector reads /proc/net/dev and filters out the loopback interface for the same reason.

How it appears. Each interface shows two rows: "Network in" (bytes received per second) and "Network out" (bytes sent per second). When an interface has no traffic, the rows show "0 B/s". The collector samples every second and computes the rate from the difference between consecutive samples, like disk activity.

Why not gauges. Network metrics appear as text rows in the Usage panel, not as gauges. A rate (bytes per second) has no natural maximum, so a gauge would suggest a limit that does not exist. The project philosophy is: "A value that is not a fraction of a maximum is read, not glanced at". Network and disk activity metrics follow this rule: they are read as text, not glanced at as gauges.

Unsupported platforms. On platforms where network interfaces cannot be read, the collector reports itself as unsupported and the dashboard shows no network rows. This is information, not a fault.

Regression tests. Three tests verify that bytes-per-second metrics do not become gauges: Fraction_WithARateValue_ReturnsNull, Fraction_WithAPercentage_ReturnsTheFraction, and Fraction_WithBytes_ReturnsNull. These tests protect the project philosophy and prevent the same bug from recurring.

The packages are NOT signed

Windows will say so twice, in two different ways, and the two are not fixed
by the same thing:

• User Account Control will show "Unknown publisher". A signature removes
  this immediately, from the first download;
• SmartScreen will warn on first run of the installer. A signature does
  NOT remove this: since March 2024 not even an EV certificate bypasses it.
  It depends on how many clean downloads the file has accumulated, not on the
  certificate it carries.

To go ahead: More info, then Run anyway.

Where this package comes from

Every attached file carries a provenance attestation signed by GitHub, which
ties it to the commit and the workflow that produced it:

gh attestation verify Observer.msi --repo Akr0n/observer

It is not an Authenticode signature and Windows does not look at it. It answers
a different and equally useful question: does this file really come from that
source code, rather than does Windows trust whoever made it.

Windows

Installs the service, the dashboard and the command line. Needs an elevated terminal:

msiexec /i Observer.msi

Nothing else needs installing: the package bundles the .NET runtime, which is
why it weighs about fifty megabytes. Up to 0.2.0 it required ASP.NET Core 10
without checking that it was there, and on a machine without it the service
died at startup while the installer talked about insufficient privileges - a
cause that had nothing to do with the real one.

Note that this means the runtime's security fixes no longer come from
Windows Update. They come with a new Observer release.

If that machine already has an Observer service registered by hand, remove it
first, and empty the installation folder.

Linux

sudo apt install ./observer_0.25.0_amd64.deb

Requires Ubuntu 24.04 or later: aspnetcore-runtime-10.0 comes from the official
archive, so the runtime is not bundled and is updated with the system.

After installing

To watch the machine you are sitting at there is nothing to configure, and no token
is needed: the dashboard uses the local channel. The token and the certificate
fingerprint are needed only so that ANOTHER computer can query this one, and you get
them with observer share.