Adventures in Monitoring

FTMON is back: a 2001 Perl monitor, rebuilt in four days with a frontier model

Twenty-five years ago I wrote FTMON in Perl. This month I brought it back as a clean MIT Python rewrite — in four days, with a frontier model and a machine-checked spec.

Twenty-five years ago I wrote FTMON, a fault-tolerance monitoring engine in Perl. It watched a single Linux host for the slow failures that real-time tools miss — memory leaks, disks quietly filling, services flapping — confirmed problems over consecutive cycles before alarming, and escalated incidents instead of spamming. It shipped on SourceForge in the 2001–2003 era and then, like a lot of software from that time, went quiet.

This month I brought it back. FTMON v2 is a complete rewrite: Python 3.11+, MIT-licensed, local-first, with bounded metric history in SQLite, a CLI, a loopback-only web dashboard, and — because it’s 2026 — a local MCP server so an AI assistant can investigate your host’s incidents alongside you.

The part I still find hard to believe: the working system came together in four days.

What got built

  • 61 commits across 10 milestones — from the first expression-language commit to a published recipe exchange.
  • ~12,500 lines of source and ~9,300 lines of tests — 488 tests running as a single deterministic gate in about 35 seconds.
  • A formal specification with 196 requirement IDs, every one traceable to the tests that verify it. The traceability index is generated from the spec and machine-checked; the “not yet covered” list was burned down to empty and a test guarantees it can only shrink.
  • A restricted, stdlib-only expression language for monitor rules (parse → IR → eval, three-valued logic, evaluation that never raises).
  • Declarative TOML monitor definitions — definitions are data, never code.
  • A hardened external-check runner compatible with the Nagios plugin convention: no shell, scrubbed environment, process-group kill, bounded output, and an argv registry so AI or definitions can reference a check but never create command authority.
  • Soak-evidence tooling, live-host tuning procedures, a static recipe exchange site, and a full user manual — because docs were part of each work package, not a follow-up.

How a frontier model made this possible

I did not type most of that code. A frontier-model coding agent (Claude, via Claude Code) did the implementation. What I supplied was the thing the model couldn’t: twenty years of opinions about how single-host monitoring should work, and a process that turned those opinions into enforceable structure.

The workflow that emerged is what I’d call spec-driven agentic development:

  1. The spec is the product. SPEC.md assigns a stable ID to every requirement (SA-06, EX-04, EC-01…). The model works against the spec, not against vibes.
  2. Traceability is a test. Every test cites the requirement IDs it verifies in its docstring; a generator rebuilds the requirement index from the spec and the suite fails on any drift. When an AI writes most of your code, “how do I know it did what I asked?” needs a mechanical answer.
  3. Invariants are frozen and enforced. The incident state machine is marked FROZEN. Time access is confined to one module. Platform behavior lives behind exactly four seams. The model is enormously capable, and guardrails are what let you use that capability at speed.
  4. Drift becomes a check. Twice the spec version and design doc drifted out of sync — so coherence became a machine-checked test and the problem never recurred. Every process failure got converted into a gate.

The result inverted the economics of a hobby rewrite. Things I would have deferred for years — a durable notification outbox with independent retry, SQLite migrations gated by PRAGMA user_version, a synthetic demo app isolated from the operational one, deterministic fixture fakes shipped in the production package — landed in the same four days as the core, because the marginal cost of doing it properly collapsed.

The old ideas survived; the code didn’t

FTMON v2 ports the 2001 design — delta and monotonic calculations, consecutive-cycle confirmation, baselining against the host’s own normal, escalation as one explainable incident — and none of the Perl. The GPL original stays on SourceForge; the MIT rewrite is clean-room by policy, and that boundary is deliberate.

That, to me, is the real headline about frontier models. They didn’t just make me faster. They made it worth resurrecting a twenty-five-year-old design that was always sound, and giving it the engineering rigor — spec, traceability, soak evidence, tuning scorecards — that a solo maintainer could never have afforded before.

One host still deserves monitoring. Now it has it again.

Try it: Install guide · Live demo · Recipe exchange · GitHub