Skip to content
fawdy
Download

Product

Less time investigating.
More time shipping.

Use cases

Root Cause Analysis
web-prod-03SEV-1

Root Cause

pgbouncer crashed 6h ago and was not restarted, causing 847 direct connections to flood PostgreSQL and trigger the OOM killer.

Timeline

  1. 03:12PagerDuty alert: high memory
  2. 03:12Fawdy connects via SSH
  3. 03:14847 idle connections found
  4. 03:15Root cause identified

Action Items

P0Restart pgbouncer
P1Add systemd restart policy

How it works

Read the evidence. Connect the dots. Write the RCA.

Fawdy works through logs, processes, and configs to build a complete picture of what happened — then writes it up.

From alert to diagnosis in minutes.
No dashboard. No query language. Just an answer.

Log correlation

Reads journald, syslogs, and application logs. Cross-references timestamps and error patterns across services to reconstruct the sequence of events.

Process & network tracing

Maps running processes, open ports, and active connections. Identifies what's talking to what and where things broke down.

Configuration analysis

Reads service configs, checks for misconfigurations, and traces dependency chains. Finds the setting that changed or the config that was never updated.

Ticket-driven investigation

Connects to Jira or Linear. When an issue comes in, Fawdy dispatches an investigation automatically and posts its findings back to the ticket.

Safety

Investigate freely. Change nothing.

Every command goes through a 4-step safety pipeline before it reaches your server. Destructive operations are blocked at the AST level, not with fragile regex or easily bypassed rules.

01

Parse

Commands are parsed into an AST. Shell tricks and injection attempts are rejected at the syntax level.

02

Validate

Checked against a curated allowlist. Default-deny.

03

Reconstruct

Arguments are re-quoted to prevent injection before reaching your server.

04

Execute

Runs over SSH on Linux or WinRM on Windows, with timeouts and output truncation. Read-only. Always.

Command Validation
$ tail -n 100 /var/log/syslog
Allowed: read-only, bounded output
$ tail -f /var/log/syslog
Blocked: follow mode hangs until timeout
$ ps aux | grep nginx | wc -l
Allowed: read-only pipeline
$ systemctl status nginx
Allowed: status checks are read-only
$ systemctl stop postgresql
Blocked: service management is not allowed
$ cat /etc/nginx/nginx.conf
Allowed: config files are read-only
$ cat ~/.ssh/id_rsa
Blocked: sensitive file access is restricted
$ grep -r error /var/log | tee /tmp/out.txt
Blocked: tee writes to disk

Powered by ShellGuard

Open Source

The core of how Fawdy safely connects to your servers is open source. ShellGuard gives any LLM read-only shell access over SSH so everyone can build on top of it, not just us.

View on GitHub