Documentation

bewitch is two programs. bewitchd is a daemon that reads /proc and /sys on a schedule, writes what it finds to a local DuckDB file, evaluates your alert rules, and serves it all over an HTTP API. bewitch is the client: a terminal UI, a SQL console (bewitch repl), and a handful of maintenance commands.

New here? Start with Installation, then open the TUI with bewitch. The defaults are sensible enough that you may never need Configuration.

bewitchd ── collectors ──▶ DuckDB ──▶ alert engine ──▶ email / chat / command
    │                         │
    └── HTTP API ◀────────────┘
          ├── unix socket   (always)       ◀── bewitch, bewitch repl
          └── TCP + TLS     (optional)     ◀── remote clients, Prometheus

Get started

Installation One-line installer, the Debian APT repo, or prebuilt binaries — plus the systemd unit. Configuration Every TOML option, what it does, and the defaults you can usually leave alone. Running on Proxmox VE What works out of the box on a Proxmox host, what to set up, and how to pull guest and storage stats from the PVE API.

Use it

TUI Guide Views, keybindings, time-range scrubbing, process pinning, and debug mode. Alerts Threshold, predictive, variance and process rules, delivered by email, chat, push or shell command. SQL REPL The SQL console over your own metrics: dot-commands, multi-line editing, tab completion, and export. Custom Sources Point bewitch at a local service's HTTP API and chart its numbers alongside everything else — no Go required. Remote Access TLS by default, trust-on-first-use fingerprint pinning, and optional bearer-token auth.

Reference

Collectors The ten built-in collectors — CPU, memory, load, disk, network, ECC, temperature, power, GPU, process — and how to tune their intervals. Storage & Archival Retention, compaction, Parquet archival, and standalone snapshots for the long haul. API Reference The HTTP endpoints behind it all — metrics, history, query, export, snapshots, alerts. Changelog What changed, version by version.