Commit Graph
399 Commits
Author SHA1 Message Date
nicolargo c8f6b41f0b Patch for InfluxDB 3 exporter 2026-09-13 18:45:27 +02:00
nicolargo 3e8e4c4ee8 Glances v5 - Fix findings of the 2026-09-13 code review
High
- config: an unreadable or unparsable glances.conf stops Glances (exit 2)
  instead of being skipped (v4 parity)
- ip: public API address policy enforced on the connection itself
  (redirects, re-resolution), shared address space rejected, credentials
  dropped on cross-origin redirects

Medium
- network: per-direction capacity is the full link speed (no /2)
- quicklook: GPU means read the gpu collection envelope
- mcp: top_processes_report accepts the collection envelope
- webserver/routes: password hashing off the event loop
- actions: no relaunch while a run is in flight, dedicated pool,
  optional [alerts] action_timeout
- alerts: vanished items resolve through hysteresis and are forgotten
- processlist: NI on 3 columns, integers never truncated
- tui: full-quicklook width leaves room for LOAD, percpu keeps its labels
  when the cascade hides quicklook, control characters painted as spaces
- fs: show/hide also match the device name
- webui: memswap/load without stats render dashes, quicklook bars keep a
  width without the CPU header, percpu twin of the quicklook rule

Low
- non-ASCII Basic auth username returns 401
- DNS rebinding warning follows --bind
- CSV export realigns reordered columns instead of rotating
- a failed cycle no longer doubles the next rate
- sensors <label>_<type> alias restored
- programs view NI formatting, Windows dpc in TUI and WebUI
- network rates 1000-1023 K/M/G fit their column
- webui footer shows resolutions as resolved, header cascade runs
  before text is cropped
- webpack dev server port parsed as a number
2026-09-13 13:09:54 +02:00
nicolargo 3dee10b3ea Remove : char in, GPU and NPU plugins 2026-09-13 10:44:50 +02:00
nicolargo 97334dbdff Correct UT for Glances v5 (use test conf file instead of system one) 2026-09-13 10:19:21 +02:00
nicolargo b6af741e6c WebUI v5 - Top bar is completed 2026-09-13 10:05:55 +02:00
nicolargo 01c3b9c01c WebUi left side bar ok 2026-09-12 20:46:08 +02:00
nicolargo 42a60cd905 Merge from develop 2026-09-12 17:44:47 +02:00
nicolargo adb96320ef Merge branch 'develop' into develop-v5 2026-09-12 17:24:52 +02:00
nicolargo f05c60d29c Merge branch 'develop' of github.com:nicolargo/glances into develop 2026-09-12 15:30:22 +02:00
nicolargo f3f50323d8 SQL Injection leading to Data Exfiltration via OOB (Out-of-Band) in Glances ClickHouse Export Module - GHSA-2hvx-g9v6-w29h 2026-09-12 15:30:08 +02:00
Nicolas Hennion dfa6137a39 Merge pull request #3732 from datrixlab/fix/connections-disable-sticks
Remember that a connections probe was disabled
2026-09-12 15:14:56 +02:00
nicolargo 98e25644c5 WebUI resize 2026-09-12 10:56:43 +02:00
datrixlab 4591a6f52d Remember that a connections probe was disabled
The connections plugin gives up on a probe that fails: psutil.net_connections
raising, or the nf_conntrack files not being there. It records that by
writing net_connections_enabled / nf_conntrack_enabled into stats, but
update() starts every refresh with

    stats = self.get_init_value()

which is a copy of stats_init_value, where both flags are True. The flag is
therefore forgotten as soon as it is written, and update() calls the failing
probe again on the next refresh. Measured with the conntrack path pointing at
a missing file and three refreshes: three reads and three
"Can not get network connections track" warnings, instead of one.

That also defeats the guard around psutil.net_connections, which is the
expensive call the plugin's own comment is about ("because it consumes lots
of CPU"), on a host where it raises, such as macOS without root.

Keep the two flags on the plugin, the way mem keeps zfs_enabled and sensors
keeps its probe state, and copy them into stats each refresh so the views and
the REST API still see them.
2026-09-12 11:36:06 +07:00
datrixlab ac741d299c Read web_x_ssl_verify as a boolean, not as a CA bundle path
GlancesWebList takes web_x_ssl_verify through config.get_value(), which
returns the raw string, and hands it to requests.head(verify=...).
Requests reads a string verify as the path to a CA bundle, so the value
from the configuration file is looked up as a file name:

    verify='false'            -> OSError: Could not find a suitable TLS CA
    verify='true'             -> OSError: ... invalid path: true
    verify=False / verify=True -> the request is actually made

ThreadScanner._web_scan catches everything and sets status='Error', so the
URL sits permanently red in the curses view and the WebUI, with only a
debug-level log line to explain it. Setting the key to true, which is what
a user does to turn verification back on explicitly, breaks the scan the
same way as false.

Read it with config.get_bool_value(), the helper the network and diskio
plugins already use for their switches, and keep a non-boolean value as a
string: a path to a CA bundle is a valid value for requests' verify, and
that is the one form that worked before.

The key was undocumented, which is probably how this survived; document it
next to the other web_x_ options in conf/glances.conf and docs/aoa/ports.rst.
2026-09-12 11:31:29 +07:00
nicolargo 84c14da071 Report patch from Glances v4 2026-09-11 19:47:48 +02:00
nicolargo e3b28bfa67 WebUI top menu ok 2026-09-11 19:40:37 +02:00
Nicolas Hennion 1756895fe9 Merge pull request #3730 from datrixlab/fix/outputs-cli-overrides-config
Let --disable-separator and --disable-bg override glances.conf
2026-09-11 19:32:50 +02:00
nicolargo 7f4079480d Report some features from Glances v4 2026-09-11 08:10:09 +02:00
datrixlab d2836579c5 Let --disable-separator and --disable-bg override glances.conf
_GlancesCurses.load_config read [outputs] separator and disable_bg with the
command-line value passed in as the default, so any value present in the
file won: with separator=True in glances.conf, `glances --disable-separator`
still drew the separator, and so did --disable-unicode, undoing main.py's
"Unicode => No separator". With disable_bg=False in the file, --disable-bg
was ignored. docs/config.rst says options given on the command line
override the configuration files.

Both flags only move one way -- --disable-separator can only turn the
separator off and --disable-bg can only turn the background off -- so keep
the value when the flag is set and let the file decide otherwise. With no
flag, or with the key absent, the result is unchanged.
2026-09-11 12:14:21 +07:00
datrixlab 2aa9c9e1bf Read a False config switch as False in get_conf_value
get_conf_value(convert_bool=True) returned bool(ret[0]). load_limits stores
a non-numeric value as a one-item list of strings, so the documented
off switch

    [processlist]
    disable_virtual_memory=False

came back as bool('False') == True and hid the VIRT column in the curses
UI -- while the WebUI, reading the same key, compares the text to "true"
and shows it. A value that parses as a number is stored as a float
instead, so disable_virtual_memory=0 or =1 raised TypeError on ret[0].

Read the text the way the *_log check a few lines above and the WebUI
already do, and take bool() of a float.
2026-09-11 12:09:36 +07:00
nicolargo 7cf524982d Report patch from develop 2026-09-10 20:37:29 +02:00
nicolargo e761611481 Correct conflict 2026-09-10 19:26:29 +02:00
Nicolas Hennion ddaa65c459 Merge pull request #3728 from datrixlab/fix/focus-filter-command-line-precedence
Replace the focus filter list on set instead of extending it
2026-09-10 19:14:36 +02:00
Nicolas Hennion 32b684c1a3 Merge pull request #3727 from ntdatt812/fix/webui-hide-zero-row-polarity
fix(webui): keep a row while any of its hide_zero fields is visible
2026-09-10 19:13:41 +02:00
Nicolas Hennion 7a6f5ba69b Merge pull request #3726 from ntdatt812/fix/network-hide-threshold-bytes
fix(network): read the hide_threshold_bytes the plugin documents
2026-09-10 19:12:11 +02:00
Nicolas Hennion a9bb613c17 Merge pull request #3725 from ntdatt812/fix/hide-zero-threshold-off-by-one
fix(views): keep hide_zero hiding a stat that never moves
2026-09-10 19:11:12 +02:00
Nicolas Hennion ffa90046c5 Merge pull request #3724 from ntdatt812/fix/containers-webui-decoration
fix(webui): colour a container's CPU and MEM the way curses already does
2026-09-10 19:09:57 +02:00
Nicolas Hennion 4c58ba1d5b Merge pull request #3723 from PGrayCS/fix/timeout-fallback-result
Fix return value in timeout permission fallback
2026-09-10 19:09:04 +02:00
Nicolas Hennion ba2c8b7fb9 Merge pull request #3722 from ntdatt812/fix/vms-decorations
fix(vms): colour the columns msg_curse already asks decorations for
2026-09-10 19:07:44 +02:00
Nicolas Hennion 2db5e73701 Merge pull request #3721 from ntdatt812/fix/rate-new-stat-in-list
fix(rate): initialise a stat that is new since the previous sample
2026-09-10 19:05:54 +02:00
Nicolas Hennion b903fa364f Merge pull request #3718 from ntdatt812/fix/npu-temperature-alert
fix(npu): alert on the temperature both interfaces already ask for
2026-09-10 19:05:05 +02:00
nicolargo 5ba16bb2a7 G9-4 done - WebUU with cpu, load, memeswap, gpu and network 2026-09-10 18:46:28 +02:00
datrixlab 1691303ab9 Replace the focus filter list on set instead of extending it
GlancesFilterList.filter appended to the existing list, so the property
never described the current filter: every assignment added to whatever was
already there. Its sibling in the same file, GlancesFilter.filter, replaces.

Both process_focus and export_process_filter are written twice in a normal
startup. The processlist plugin reads glances.conf when it loads
(plugins/processlist/__init__.py), and the command line is applied just
after -- set_args() for the focus filter, standalone.py for the export one.
Appending left both live, and is_filtered() ORs them, so

    focus=.*firefox.*         in glances.conf
    glances --process-focus .*python.*

focused on firefox and python together. The command line could widen the
list from the configuration file but never narrow it, while config.rst
states that "options given on the command line overrides both".

Assigning the whole list restores that precedence: the configuration file
is read first, the command line replaces it.
2026-09-10 09:06:36 +07:00
Nguyen Thanh Dat ff80c90355 fix(webui): keep a row while any of its hide_zero fields is visible
hide_zero is decided per field but applied per row, and the two front ends
read that per-field verdict in opposite directions.

msg_curse drops a disk only when *all* of its hide_zero_fields are hidden:

    if all(self.get_views(item=..., key=f, option='hidden') for f in self.hide_zero_fields):
        continue

plugin-diskio.vue and plugin-network.vue keep a row only when *all* of them
are visible:

    return (
        (!readBytesRate || readBytesRate.hidden === false) &&
        (!writeBytesRate || writeBytesRate.hidden === false)
    );

Those agree while both fields say the same thing, and disagree the moment
one moves and the other does not -- a disk that has only ever been read, an
interface that has only ever received. Curses shows it; the browser drops
it entirely.

Use the same rule as msg_curse in both components.
2026-09-09 14:52:11 +07:00
Nguyen Thanh Dat d88f9d9820 fix(network): read the hide_threshold_bytes the plugin documents
Both the reference configuration and docs/aoa/network.rst offer the option
under [network]:

    [network]
    hide_zero=True
    hide_threshold_bytes=0

but NetworkPlugin never read it, so it stayed at the base class default of
0 whatever the user wrote. diskio has read it since the option was added;
network was left out.

Nothing reports an option a plugin ignores: hide_zero keeps working, it
just never applies the threshold, so an interface carrying a trickle of
background traffic is shown when the user asked for it to be hidden.

Read it beside hide_zero, exactly as diskio does.
2026-09-09 14:48:17 +07:00
Nguyen Thanh Dat cc5e2bab65 fix(views): keep hide_zero hiding a stat that never moves
The reference configuration documents the boundary for both plugins that
use the feature:

    # Set hide_threshold_bytes to an integer value to automatically hide
    # interface with traffic less or equal than this value
    #hide_threshold_bytes=0

"less or equal than this value", with a documented default of 0, means a
rate of exactly 0 is hidden. The comparison un-hid on `>=` instead, so at
the default threshold every zero rate satisfied `0 >= 0` and the row came
straight back.

The first refresh still hides, because it has no previous view to carry
forward and falls into the `else` branch. From the second refresh on,
nothing was ever hidden again -- which is why `hide_zero=True` looked like
it worked for one frame and then stopped.

This restores the behaviour that `i[field] != 0` had before the threshold
option was introduced, and honours a non-zero threshold the way the
configuration file describes it.

Tests pin the boundary rather than any rendered message: the views dict
keeps every key either way, only `hidden` moves.
2026-09-09 14:46:17 +07:00
Nguyen Thanh Dat 6017667a56 fix(webui): colour a container's CPU and MEM the way curses already does
The containers plugin decorates each container's cpu and mem against that
container's own threshold from the config file, falling back to the global
one. The curses view reads both. plugin-containers.vue did not: it rendered
the two cells as plain text in both its narrow and wide tables, so a
container over its limit was red in the terminal and black in the browser.

The component already exposes the views it needs -- it uses them for
show_engine_name and show_pod_name -- so this only adds the reader and the
two class bindings, defensive the same way plugin-diskio.vue is for a
container present in stats but not yet in views.

The added test pins the server half of the pair: without it, removing the
decoration upstream would take the colour out of both front ends silently,
since get_views() answers DEFAULT for a key it cannot find.
2026-09-09 14:25:51 +07:00
PGray 8870aa1344 Use unittest assertion for fallback regression test 2026-09-08 21:35:24 +01:00
PGray 60b666772f Fix return value in timeout permission fallback 2026-09-08 21:29:30 +01:00
Nguyen Thanh Dat ef11e7d48a style(vms): wrap two test lines over the 120-column ruff limit 2026-09-08 14:36:17 +07:00
Nguyen Thanh Dat f8657a0a97 fix(vms): colour the columns msg_curse already asks decorations for
The VM table asks for a decoration on four columns:

    self.get_views(item=vm['name'], key='cpu_count', option='decoration')
    self.get_views(item=vm['name'], key='cpu_time_rate_per_sec', ...)
    self.get_views(item=vm['name'], key='memory_usage', ...)
    self.get_views(item=vm['name'], key='load_1min', ...)

Nothing ever set one. No vms field declares `alert` or `log`, so the base
`_build_field_decoration` returns 'DEFAULT' for all of them, and
`update_views` only computed `show_engine_name`. Every one of those four
reads has always come back 'DEFAULT', which makes the VM table the one
table that never changes colour -- the sibling containers plugin has done
this since it was written.

Three of the four get thresholds, with the per-VM override and DEFAULT
fallback containers already uses. `cpu_count` keeps its read and no
colour: a core count is not a threshold.

Decorations are written onto the views the base already built rather than
replacing them, so `optional` and `hidden` survive -- containers replaces
the whole per-item view, which is why its curses code reads nested 'cpu'
and 'mem' keys instead of field names.

Thresholds are commented out in the shipped conf, so the table stays
exactly as it is until someone opts in.

Verified with tests/test_vms_decorations.py (9 passed) and by reverting
each claim: measuring memory against a fixed maximum instead of the VM's
own memory_total fails 4 tests, dropping the per-VM override fails 1.

A `value is None` guard was written first and removed: `get_alert` already
answers DEFAULT for a missing value, because the percentage it computes
raises TypeError and is caught, so no test could tell the guard from its
absence. A test pins that behaviour instead.
2026-09-08 09:21:09 +07:00
Nguyen Thanh Dat 9029fd66d0 fix(rate): initialise a stat that is new since the previous sample
compute_rate_on_list() looked up each stat's previous sample by key and
skipped the stat entirely when there was none. Interfaces, disks and VMs
appear while Glances is running -- a VPN comes up, a container starts, a
disk is plugged in -- so a stat with no previous sample is not only a
start-up case, and the plugins that carry rate fields on a list are
network, diskio and vms.

A skipped stat kept the raw psutil counter in the delta field and got no
_gauge, no _rate_per_sec and no time_since_update at all. Two consequences:

  * That refresh published the whole since-boot total as if it were one
    refresh of traffic. On a quiet link the first sample of a new
    interface reads in gigabytes.

  * NetworkPlugin.update_views() assigns
    views/<iface>/bytes_recv_rate_per_sec directly. Views are built only
    from the fields a stat actually carries, so there was no view to
    decorate and the refresh raised KeyError: 'bytes_recv_rate_per_sec'.

Give compute_rate an empty previous instead of skipping, which is the
path a dict stat already takes on its own first sample: record the gauge,
publish a rate of 0, and measure a real delta on the next sample. The
stat then also reaches its second sample one refresh sooner, because the
gauge it needs is now recorded the moment it appears.

Verified on Windows with the full suite: the set of failing test names is
byte-identical before and after (63 pre-existing environment failures,
xmlrpc and browser-restful servers). Reverting the one changed line turns
4 of the 5 new tests red, including the KeyError one; the fifth is the
guard that the neighbouring stat is undisturbed, so it stays green.
2026-09-07 15:13:36 +07:00
Nguyen Thanh Dat 20555568ff fix(npu): alert on the temperature both interfaces already ask for
update_views() replaced the base class's per-field views with a dict naming
only load, freq and mem, so views[npu_id]['temperature'] did not exist. Both
readers then fell back to no style: msg_curse's get_views() returns 'DEFAULT'
for a missing key, and the WebUI's getDecoration returns undefined. An Intel
NPU -- the one driver that reports the reading -- was printed plain at any
temperature.

Adds the key and the alert, mirroring the GPU plugin, which has had the same
three alerts (proc/mem/temperature) all along. A card whose driver leaves the
reading None (AMD, Rockchip) keeps a view with no decoration rather than being
alerted on nothing.

conf/glances.conf gains the matching [npu] temperature thresholds, using the
same 60/70/80 ladder as [gpu]: without limits get_alert() returns DEFAULT, so
the code half alone would change nothing.
2026-09-07 10:26:25 +07:00
Nguyen Thanh Dat 26a9fe96dd fix(quicklook): colour each --percpu bar by that core's own load
Both interfaces drew every per-core bar with the aggregate CPU style:
`_msg_create_line` read `views['cpu']['decoration']` for every row, and
plugin-quicklook.vue called `getDecoration('cpu')` inside the percpu loop.
A core pegged at 100% among idle ones was therefore painted with the colour
of the average, which is the one number that cannot show it.

update_views now publishes `views['percpu_decoration']`: a style per core,
plus 'other' for the row that averages the cores neither interface shows.
Both interfaces read it, so they agree.

The styles are computed from the plugin's own quicklook_cpu_* limits rather
than through get_alert(), because get_alert() also records a threshold that
glances.events_list reads and can run a configured action, and both are keyed
by the stat name alone. Every core shares 'quicklook_cpu' with the aggregate,
so a per-core call would leave the last core as the value those two see.

Also drops a duplicated `msg = msg =` assignment on a line already touched.
2026-09-07 10:07:07 +07:00
nicolargo 4986c901d4 First version of the WebUI with Mem and Network 2026-09-06 21:25:14 +02:00
nicolargo dd53508e9c Serve the WebUI from the v5 FastAPI app, add /api/5/args (#1527) 2026-09-05 18:20:06 +02:00
nicolargo ef2a09cca4 Filter the REST/MCP payload through the plugin, add AMP result_float (#3211, #3423, #1527) 2026-09-05 16:32:23 +02:00
nicolargo edfa8c2673 Migration of InfluxDB exporter 2026-09-05 16:10:24 +02:00
nicolargo bcb89f0496 Prometheus migration 2026-09-05 15:48:34 +02:00
nicolargo 84da2bfa0b Merge branch 'GHSA-56xw-p9qm-r437' into develop 2026-09-05 15:17:22 +02:00