# SnapStat v0.3.0 sys-snap and sysstat Web Interface for cPanel/WHM and CWP [](https://www.youtube.com/watch?v=l6C9AdDgy_I) [Demo Video on YouTube](https://www.youtube.com/watch?v=l6C9AdDgy_I) - cPanel/WHM path: `/usr/local/cpanel/whostmgr/docroot/cgi/imh-snap-stat/index.php` - CWP path: `/usr/local/cwpsrv/htdocs/resources/admin/modules/imh-snap-stat.php`  # Installation (simple) Run as root: ```bash bash <(curl -fsSL https://gitlab.panelplugins.com/plugins/imh-snap-stat/-/raw/master/install.sh || wget -qO- https://gitlab.panelplugins.com/plugins/imh-snap-stat/-/raw/master/install.sh) ``` # Installation (secure) Releases are GPG-signed. **Verify the installer before running it as root.** ## 1. Import the release signing key (one time) The InMotion Hosting plugin release key fingerprint is: ``` B3DD9A05160F504476211834281076F1620A6F53 ``` Import the public key — either from a public keyserver: ```bash gpg --keyserver hkps://keys.openpgp.org --recv-keys B3DD9A05160F504476211834281076F1620A6F53 ``` …or by downloading and importing the armored key file: ```bash curl -fsSL https://gitlab.panelplugins.com/plugins/imh-snap-stat/-/raw/master/release-pubkey.asc | gpg --import ``` After import, confirm the imported key's fingerprint matches the value above: ```bash gpg --fingerprint B3DD9A05160F504476211834281076F1620A6F53 ``` ## 2. Verify and run the installer Download the installer and its detached signature, then verify: ```bash BASE=https://gitlab.panelplugins.com/plugins/imh-snap-stat/-/raw/master curl -fsSL -O "$BASE/install.sh" curl -fsSL -O "$BASE/install.sh.asc" gpg --verify install.sh.asc install.sh ``` The output will end with `WARNING: This key is not certified with a trusted signature!`. **This is expected and is not an error.** gpg distinguishes a cryptographically valid signature (the `Good signature` line above the warning) from a key you have personally certified as trusted. As long as the printed `Primary key fingerprint` matches the value in step 1, the installer is authentic. To silence the warning on future verifications, after confirming the fingerprint you may locally certify the key (no public signature is published; only your local keyring is updated): ```bash gpg --lsign-key B3DD9A05160F504476211834281076F1620A6F53 ``` Once verified, run the installer: ```bash sudo bash install.sh ``` `install.sh` then fetches a signed `MANIFEST.txt` and verifies every other release artifact (`index.php`, `sys-snap.pl`, etc.) against it. Any signature or hash mismatch aborts the install before anything is written. ## Uninstall ```bash sudo bash install.sh --uninstall ``` [](https://en.wikipedia.org/wiki/Interquartile_range) # Files ## Shell installer - install.sh - main installer; embeds the release public key and its fingerprint - install.sh.asc - detached GPG signature of `install.sh` (produced by `release.sh`) ## Release manifest - MANIFEST.txt - `sha256sum`-format list of every release artifact (produced by `release.sh`) - MANIFEST.txt.asc - detached GPG signature of `MANIFEST.txt` ## Main script - index.php - Identical to `imh-snap-stat.php`. - imh-snap-stat.php - Identical to `index.php`. ## Javascript - imh-snap-stat.js - Bundle React or any other javascript in this file. ## Icon - imh-snap-stat.png - [48x48 png image](https://api.docs.cpanel.net/guides/guide-to-whm-plugins/guide-to-whm-plugins-plugin-files/#icons) ## cPanel conf - imh-snap-stat.conf - [AppConfig Configuration File](https://api.docs.cpanel.net/guides/guide-to-whm-plugins/guide-to-whm-plugins-appconfig-configuration-file) ## CWP include - imh-plugins.php - [CWP include](https://wiki.centos-webpanel.com/how-to-build-a-cwp-module) ## Releasing (maintainers) Releases are signed by the maintainer's GPG key, whose fingerprint is embedded in `install.sh` (`RELEASE_KEY_FINGERPRINT`) and in the armored block returned by `release_pubkey()`. To cut a release: ```bash RELEASE_KEY_ID=<full-40-char-fingerprint> ./release.sh ``` `release.sh` regenerates `MANIFEST.txt` (sha256 of every release artifact), signs it as `MANIFEST.txt.asc`, and signs `install.sh` as `install.sh.asc`. Upload all four files plus the artifacts listed in `MANIFEST.txt` to the release URL. To rotate the release key, generate a new key, update `RELEASE_KEY_FINGERPRINT` and the `release_pubkey()` armored block in `install.sh`, then rerun `release.sh`. # Changelog ## v0.1.6 - Release - Release ## v0.1.7 - Fix for some newer OS's that use a new format to store sysstat logs. ## v0.1.8 - Fixed error handling of time-range inputs that fail to return sys-snap output. - "Scores from..." now shows the actual time-range, specifically when sys-snap has been running for less than 24 hours. - "Scores from..." now shows the local time zone. - Added step to `chmod 0600` cache files when created. - Implemented statistical outlier detection (IQR method) for all numeric columns in the sar data table. Cells with statistically and operationally significant values are now automatically highlighted. - `/opt/imh-sys-snap/bin/` path to the sys-snap.pl file is no longer hard-coded; it now checks other possible paths. - Fixed caching functions to prevent path traversals and race conditions. ## v0.1.9 - Set the IMH-installed sys-snap.pl path as default instead of cPanel's /root/sys-snap.pl path. - Install script CWP 3rdparty.php fixes for a double-insertion bug. ## v0.2.0 - Fix for determineSarLogPath() edge cases when /var/log/sa stale files exist. ## v0.2.1 - Fix for fatal errors when sys-snap reports numeric UIDs by normalizing user labels and using stable placeholder names for unresolved accounts (PHP 5/7 compatible). ## v0.2.2 - Numerous fixes, compatiblity for Ubuntu ## v0.2.3 - Installation security overhaul, brand design changes ## v0.2.4 - install.sh URL fix ## v0.2.5 - Tab view fix when reloading plugin ## v0.2.6 - sys-snap view now silently includes the most recent archived session, so the full pre-reboot window (e.g. the load climb leading up to a crash) is visible instead of only post-boot data. The newest `system-snapshot*.tar.gz` is extracted into the plugin cache and read via `--dir`; the live `system-snapshot/` dir is never modified, and archived (pre-reboot) logs win over live logs on HH:MM collisions. Only archives newer than 24h are merged (sys-snap's rolling window), so a long-running server with old archives reads its live data unchanged and the "includes archived session" note only appears when a recent session rotation/reboot actually pulled archived data.