Figure out which Redis key pattern or command is causing a performance slowdown after a deploy.
Audit a shared Redis cache to see which service and commands are hammering it.
Check a service before launch for dangerous commands like scanning the entire keyspace.
See what an app sends to Redis even when the connection is encrypted with TLS.
| yeet-src/redissnoop | 0xpira/sskills | arulsebastin71/smartqueue | |
|---|---|---|---|
| Stars | 25 | 25 | 25 |
| Language | JavaScript | JavaScript | JavaScript |
| Setup difficulty | moderate | easy | moderate |
| Complexity | 4/5 | 2/5 | 3/5 |
| Audience | developer | developer | developer |
Figures from each repo's GitHub metadata at analysis time.
Linux only, needs kernel BTF and uprobe support (on by default on current Ubuntu, Debian, Fedora), encrypted capture requires the client to use dynamically linked OpenSSL.
redissnoop is a live monitoring tool that shows exactly what an application is doing to a Redis database, without changing the application, running a proxy, or adding any load to the Redis server itself. It works by watching the operating system's kernel directly, reading the raw network traffic between the app and Redis, and it can even see the contents of traffic that is encrypted with TLS by reading it just before encryption happens inside the app's own TLS library. Once running, it shows a live count of commands per second, a breakdown of how many were seen encrypted versus in plain text, and a count of risky commands in use. There are three tabbed views. The first is a Report tab that lists problems worth fixing, worst first, such as a single type of key dominating traffic, a particularly hot key, or a dangerous command being used. The second, Key Patterns, groups traffic by the shape of the keys being accessed, such as treating user:1839 and user:204 as the same pattern, showing which patterns make up most of the load. The third, Command Mix, groups traffic by the actual Redis command being run and flags commands that are cheap to type but expensive to run on a live server, like scanning the entire keyspace. It requires Linux with certain kernel features enabled, which are on by default on current Ubuntu, Debian, and Fedora, plus a small privileged helper program called yeet to load its kernel-level monitoring code. The encrypted traffic view only works if the connecting client uses a dynamically linked OpenSSL library, and it only sees plaintext traffic sent over regular network connections rather than local Unix domain sockets. It is meant as a traffic profiler, not a precise latency measurement tool, and it never shows the actual values stored in the database, only which commands and key patterns are running. Installation is a single command that installs the underlying yeet tool and then runs redissnoop directly from its GitHub repository. The project is released under the GPL-2.0 license.
redissnoop is a zero-config Linux tool that shows live Redis traffic, including encrypted commands, straight from the kernel without touching the app or adding load to the server.
Mainly JavaScript. The stack also includes JavaScript, JSX, eBPF.
GPL-2.0 license: you can use and modify the code, but any distributed modified versions must also be released under the same license.
Setup difficulty is rated moderate, with roughly 5min to a first successful run.
Mainly developer.
This repo across BitVibe Labs
double-check against the repo, no cap.