wtftools

wtf — one read-only command that tells you what's wrong with a Linux box right now.

No agent. No daemon. No config. No network calls. No dependencies (Python standard library only; psutil optional). Safe to run on production over SSH — it only reads. Try it in two seconds, nothing to install: pipx run wtftools

English | Español | Português | Français | Deutsch | Italiano | Русский | 中文 | 日本語 | हिन्दी | 한국어

Instead of running ten commands (htop, df -h, journalctl, systemctl --failed, ss, dmesg, …) you run one:

$ wtf
# AUDIT
[ OK ] uptime                  3d 4h 12m
[ OK ] load average            0.42 0.51 0.55 / 8 CPU
[ OK ] memory                  4.1GB / 16.0GB used (25%)
[WARN] disk /var               17.0GB / 20.0GB used (85%)
[FAIL] failed systemd units    1 failed unit(s)

  Summary: 12 ok · 1 warn · 1 fail · 2 skip

Green is fine, yellow needs a look, red needs fixing. Two ways admins live in it:

• Incident — something feels off → wtf → a green/yellow/red checklist instead of ten scattered commands.
• Daily — wtf daily as the morning check, wtf in your MOTD login banner, wtf audit --alert … from cron. No monitoring stack required.

What it can do

• Health audit — 35+ checks (disk, memory, swap, load, PSI, OOM kills, failed units, cert expiry, SMART, temperatures, DNS, …) as a green / yellow / red checklist.
• Per-resource views — ask about one thing at a time, like show commands on a switch: wtf disk, wtf cpu, wtf mem, wtf net, wtf docker, …
• Incident triage — wtf problems, wtf events, wtf logs, wtf services <unit>, wtf explain (optionally through a local or hosted LLM).
• Trends & alerting — wtf daily, snapshots + wtf diff, cron alerts — no monitoring stack required.
• Scriptable — -f json on every command and -f plain (tab-separated) on the resource and audit views; the JSON carries a schema_version so scripts survive upgrades — for grep / awk / jq.
• Beginner-friendly — --show-commands prints the classic commands each view replaces, so you can learn them by hand.

Install

pipx install wtftools          # recommended — works on any modern distro
pip install wtftools           # or classic pip (core, no dependencies)
pip install wtftools[full]     # + psutil for richer process/socket info
sudo dpkg -i python3-wtftools_*.deb    # Debian/Ubuntu package (see Releases)

After install you have the wtf command. Enable <Tab> completion by adding one line to your shell rc:

echo 'eval "$(wtf completion bash)"' >> ~/.bashrc   # bash
echo 'eval "$(wtf completion zsh)"'  >> ~/.zshrc    # zsh

New here? Start with the 5-minute quickstart.

Commands

Run wtf <command> --help for flags. Each command links to its reference page with examples.

Health & monitoring — docs/AUDIT.md

Resource views — docs/RESOURCES.md

Output & configuration

wtftools absorbs and supersedes checkcrontab — the same cron validator now lives at wtf crontab.

Documentation

• QUICKSTART.md — 5-minute onboarding and a cheat sheet
• AUDIT.md — health checks, monitoring, exit codes, the full check list
• RESOURCES.md — per-resource views with examples
• OUTPUT.md — plain/json formats and the scripting cookbook
• CONFIG.md — config file, thresholds, ignoring checks
• ROADMAP.md — what's planned and what's out of scope

Compatibility

• Python 3.9+
• Linux (systemd distributions are the happy path; the tool degrades gracefully when systemctl / journalctl / psutil are missing)
• No network access required for the core CLI; optional network only for wtf explain --llm … and wtf doctor --check-updates

From source

git clone https://github.com/wachawo/wtftools
cd wtftools
pip install -e .
python3 wtf.py audit       # or run it without installing

License

MIT