SIA Proto — Building a Local-First System Monitoring Agent with Unix-Socket IPC and Optional LLM Enrichment
How a Rust agent monitors CPU and memory, persists events to SQLite, exposes a JSON-RPC CLI over a Unix socket, and optionally enriches insights via a local Ollama model — all within a 200 MB memory budget and a systemd service.
The problem
Existing system monitors either pull telemetry to the cloud, require heavy runtimes, or lack a scriptable interface for local automation; the constraint was a persistent Linux agent that stays under 200 MB RSS, survives reboots via systemd, answers CLI queries over a zero-copy Unix socket, and keeps all data on disk without external dependencies.
The solution
Built the agent in Rust on Tokio with sqlx-backed SQLite for event storage, a JSON-RPC server on a Unix socket for the CLI, clap for command parsing, and a gated Ollama client that only activates when configured — deployed via an install script that places binaries in /usr/local/bin, config in /etc/sia, data in /var/lib/sia, and the socket in /run/sia.
Outcomes
- The agent runs as a systemd service with a 200 MB memory budget and 500 MB disk quota, auto-starting on boot.
- Unix-socket JSON-RPC lets the CLI query status, list events, and show details with sub-millisecond latency and no HTTP overhead.
- SQLite persistence survives restarts and supports time-range queries for forensic analysis of CPU and memory spikes.
+2 more in the write-up
Inside the write-up
- Why a local-first agent instead of existing tools
- Workspace architecture and crate boundaries
- Collection and analysis loop
- Storage schema and query patterns
- IPC protocol and CLI contract
- LLM enrichment as an optional layer
- Installation, service management, and dev ergonomics