Fixed queries over flexible CLI
Operational usefulness comes from consistent evidence, not from recreating a terminal in the browser.
MacDaddy module / observability
LogNinja
Search and classify switch logs across an inventory scope without turning a convenient web interface into an arbitrary remote command runner.
01 / Problem
Fleet troubleshooting needs scope and history, not hundreds of terminals.
Network devices have limited local log space, so the evidence I needed could roll away before a pattern became obvious. Opening device after device also made it hard to tell whether an event was isolated or happening across the fleet.
LogNinja consolidates that evidence. It resolves approved targets from inventory, runs a fixed read-only command set, streams progress, classifies known event families, tracks collection health, and retains searchable evidence so I can pinpoint recurring issues faster.
Why the guardrail matters
I did not build a web terminal. The browser can choose a supported search mode, but it cannot send an arbitrary command string to a switch. Consistent evidence was more valuable—and safer—than unlimited flexibility.
ScopeInventory-backed device, building, or approved global search
ClassifySeverity and event families from retained lines
OperateSchedules, cancellation, health, search, and export
02 / Architecture
Static commands feed a controlled evidence pipeline.
Search UIValidated mode, scope, filters, schedules, progress, retained evidence, export.
Target resolverConverts approved inventory scope into a bounded device set.
CollectorRuns only static read-only commands with cancellation and output limits.
ClassifierParses timestamps, severity, event family, device, and collection health.
RetentionPersists searchable lines and prunes them according to configurable policy.
03 / Workflow
Collect, classify, retain, and show data health.
Choose a validated scope
Resolve a device or inventory-backed group; global work receives a separate confirmation.
Run the static command set
Collect read-only log evidence with shared resource limits and cancellation support.
Classify the stream
Identify link, authentication, power, spanning-tree, and informational events.
Track failed collectors
Keep unreachable and unhealthy devices visible so missing data is not mistaken for a quiet network.
Search or schedule
Retain lines for later filtering, schedule repeat captures, and export a sanitized report.
04 / Safety model
No arbitrary command string crosses the API.
Static command setThe server owns the exact read-only commands; the browser chooses only a supported mode.
Validated scopeTargets resolve from approved inventory and typed query rules.
Global confirmationLarge-scope collection requires explicit acknowledgement.
Access-controlled routesPage and scheduled work honor current effective permissions.
Cancellation + capsJobs can stop and retained output is bounded.
Secret redactionShared logging removes registered and labeled sensitive values.
05 / Product evidence
Search and alert views keep the pattern connected to collection health.
06 / Decisions
Collection health is part of the result.
Unreachable is visible state
Repeated collector failures remain searchable so a gap in evidence cannot look like an absence of events.
Permission-aware schedule renewal
Recurring collection can renew only while the creator remains authorized and encrypted credentials remain available.
Synthetic public lab design
A safe demonstration can replay link flap, authentication, power, spanning-tree, benign, and unreachable-device fixtures through the classifier—without any device connectivity.
07 / Lessons
Silence can mean healthy—or missing data.
Fleet observability needs two parallel answers: what did the devices report, and which devices failed to report at all? Treating both as first-class evidence prevents false confidence and makes schedule gaps diagnosable.
- Classification is intentionally bounded to known event families and preserves unmatched evidence for review.
- Retention varies by configured build; this page avoids claiming one universal duration.
- Show-tech collection is separate and more explicitly confirmed than ordinary log capture.