Samsara
Source repository: oceans2alaska/Samsara.
Windows Server and Red Hat Enterprise Linux retirement assessment. Collect inventory, review dependencies and risks, and save evidence-based reports. Python 3.11+ and PySide6.
Get started
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
python -m samsara.main
On Windows, create the environment with py -3 -m venv .venv and activate .venv\Scripts\activate. Run from the project root in a desktop session.
Linux desktop compatibility includes Mint. Debian-based desktops may need python3-venv libegl1 libopengl0 libxcb-cursor0 libxkbcommon-x11-0 installed through their package manager. If Qt reports a missing xcb cursor library, install the package providing libxcb-cursor.so.0.
Analyze
- Open Analyze. Leave Assessment source → This computer and Operating system → Auto-detect selected.
- Click Analyze. The app identifies the local OS, runs its available read-only collector and prepares the assessment report.
- The Summary page opens automatically with a retirement risk estimate, OS type/version, important software and enabled scheduled jobs/scripts. Higher scores mean more retirement concerns; the score is not retirement approval.
- Open detailed tabs for Networking, Software, Tasks, Dependencies, Services, Storage, Roles, Certificates, Risk findings, Collection checks and System. Tables are searchable and sortable.
- Click Save HTML report, or use Reports to export HTML/JSON. History reopens assessments from this session.
Explicit profiles include Windows Server 2016, 2019, 2022 and 2025; RHEL 7 (legacy), 8, 9 and 10; and RHEL-compatible Linux. A local profile must match the detected OS. Auto-detect also allows local testing on other Linux distributions. Profile choices do not imply that every live collector is implemented or every release is validated.
Choose Saved inventory file to analyze existing JSON; the recorded OS is displayed without probing another computer. Windows Server sample and RHEL sample provide clearly labeled synthetic examples. No synthetic results are loaded into history automatically.
Windows Server assessments: local collection
Local Windows collection is implemented for the Server 2016/2019/2022/2025 release builds. Acceptance is pending a successful real inventory on an authorized Windows Server. Development was performed on Linux, without a PowerShell runtime. Synthetic tests are not Windows compatibility certification.
Use an existing authorized account on the Windows Server being assessed. The collector runs locally; a Windows 10/11 desktop cannot scan another server in this phase. No WinRM, SSH, agent installation, domain administrator account or saved credentials are required. Local elevation is never automatic. Start with least privilege; denied/hidden scopes become failed or partial checks. If your organization authorizes a local elevated token for broader inventory, open that session yourself. AppLocker/WDAC, constrained language and script signing/execution policies may block collection; follow your organization's approved signing/distribution process. The app does not bypass policy.
GUI on a compatible Windows desktop environment
Use 64-bit Python 3.11+ already available on the authorized execution host. Keep powershell/, schemas/ and samsara/ together in the checkout. From its root in Command Prompt:
py -3 -m venv .venv
.venv\Scripts\python.exe -m pip install -r requirements.txt
.venv\Scripts\python.exe -m samsara.main
Choose Analyze → This computer → Auto-detect → Analyze, or select the matching Windows Server release. Windows PowerShell 5.1 at the Windows system path performs the local inventory in the background. Review the Summary and each tab, especially Collection checks, then save HTML/JSON. The history and report source say Local Windows read-only collection. Cancel terminates and reaps the active PowerShell process and keeps the previous assessment. Each section has a 45-second limit, overall execution a 300-second budget, and output a 10 MiB limit; timed-out sections remain visible as incomplete.
Qt desktop compatibility is separate from collector compatibility. Current Qt 6.12 lists Windows 10 1809+ and Windows 11 as supported desktops; do not assume a Qt GUI will run on Server 2016 or Server Core. Use headless collection on those hosts and analyze the resulting file on a compatible desktop. See Qt's Windows platform requirements.
Headless Windows collection (including Server Core / Server 2016)
With existing 64-bit Python 3.11+, no PySide6 installation or graphical desktop is required. From the repository root in Command Prompt:
py -3 -m venv .venv
.venv\Scripts\python.exe -m pip install "jsonschema>=4.21,<5"
mkdir reports
.venv\Scripts\python.exe -m samsara.collectors.windows --output reports\windows-inventory.json
Use a new filename; the CLI will not overwrite an existing file. The CLI uses the same supervised collector, server identity gate and schema validation as the desktop. Copy the JSON manually to the reporting desktop and choose Saved inventory file, then Analyze. Imports retain timestamps, safe error codes and the presence of permission limitations, remove raw diagnostics/source claims, and recalculate risk. No remote transport is implemented.
If Python is unavailable, the PowerShell-only driver can produce an inventory with no Python/Qt dependency, subject to your existing script policy. From a local Windows PowerShell 5.1 prompt in the checkout root:
$json = & .\powershell\Get-ServerInventory.ps1
if ($LASTEXITCODE -ne 0) { throw 'Local inventory collection failed.' }
[IO.File]::WriteAllText((Join-Path $PWD 'windows-inventory.json'), $json, (New-Object System.Text.UTF8Encoding($false)))
Choose a new destination in the final line to retain earlier evidence. This direct path is not supervised by Python's time/output/cancellation bounds; prefer the Python CLI where available. Import validates the returned schema before desktop analysis.
Coverage and missing evidence
| Section | Collected | Known limitations |
|---|---|---|
| System | OS caption, Server release/build, boot, IPs/adapters, domain membership | Requires readable CIM identity; AD enrichment not performed |
| Roles | Installed roles/features, state and feature type | Local ServerManager/module access needed; installation does not prove use |
| Services | All visible states, startup type, account, PID | Includes running services; command lines and secrets deliberately excluded |
| Networking | TCP listeners/connections, endpoints, PID/name | Snapshot only; direction, historical use, UDP and protected processes may be unknown |
| Tasks | Visible task names/paths, state, enabled setting, principal, safe executable basename and selected trigger fields | No arguments, XML, inline scripts, event query details or execution history; visibility depends on account |
| Software | Machine uninstall registrations in both registry views | No Win32_Product; per-user, portable, container and unregistered applications not covered |
| Storage / shares | Local volumes, capacity/free space, configured SMB share paths including administrative shares | No contents/ACLs/backups; optional read-only open-file aggregate counts identify business-share activity only when the share root can be correlated without an administrative alias |
| Certificates | Subject, issuer, expiry, thumbprint and machine store | No private keys, user stores, file-based certificates or application bindings |
Each check includes status, UTC start/end times, sanitized errors, permission limitations and scope limitations. complete means the stated query scope succeeded; it does not prove complete retirement evidence. Sensitive checks run non-elevated are conservatively partial. Some Windows providers can silently filter objects by ACL; even elevated results need administrator review. Partial accessible data are retained. Invalid/unsupported Server identity stops the assessment; failed other checks never receive demo replacements.
Required real-host validation (still outstanding)
On a supported, authorized Server, use the headless environment above and a new output directory:
.venv\Scripts\python.exe -m unittest discover -s tests -v
.venv\Scripts\python.exe tools\validate_windows_host.py --output-dir reports\windows-validation-01
The second command performs real local collection, validates the inventory schema and writes windows-assessment.json, windows-assessment.html and validation-summary.json. Review the full report privately. The summary omits hostnames, service accounts, IPs, paths and certificate identifiers and is suitable for sharing validation status after review. It reports per-section status/error codes and row counts; it does not claim retirement approval. Run under the intended least-privilege account and, only if authorized, repeat in an elevated session with a different directory to assess visibility differences.
| Release | Python synthetic fixtures / orchestration / UI | Native PowerShell runtime | Actual host inventory |
|---|---|---|---|
| Server 2016 | Passed | Not run here | Pending |
| Server 2019 | Passed | Not run here | Pending |
| Server 2022 | Passed | Not run here | Pending |
| Server 2025 | Passed | Not run here | Pending |
The implementation is not considered complete until real-host evidence is obtained. Do not describe the pending rows as tested Windows support. Packaged Windows installers are also unvalidated.
Linux collection and common safety
The Linux collector observes OS/kernel/boot information, addresses, loaded systemd services and timers (including available calendar/next-run metadata), readable system cron entries, TCP snapshots, RPM or dpkg software and mounted filesystems. Missing commands or restricted permissions produce visible failed checks. Service accounts, user crontabs/timers, anacron/periodic-script configuration, certificate locations, share exports, disk capacity/free space and directory integration remain incomplete or uncollected. Results reflect the execution process's namespace and permissions. Remote mounts are not accessed.
Collection is read-only, requires no sudo and does not restart services, configure remoting, install software or read private keys, secret-bearing command lines or environment variables. Cancel stops the active collector and retains the previous assessment. Commands have time and output limits.
The summary highlights name-matched server software and running application services; this is not a complete application classifier. Scheduled entries show configured work, not confirmed execution, and cron timezones are unverified. Full inventory and collection limitations remain available in the tabs and exported report.
Retirement risk and confidence
Scoring model v2 scores grouped workload evidence, not inventory counts. The final 0–100 score is the strongest workload score; services, ports and clients supporting the same workload are not added. Standard Windows services/features, default administrative shares, browser/Steam client activity, unknown traffic and collection failures do not automatically receive risk points. Installed/stopped software is not active-use evidence.
Coverage percentage and evidence confidence are displayed separately. Failed task/certificate checks lower confidence and require review without implying an active application. Low/zero risk never grants retirement clearance: historical usage validation, business ownership and administrator approval are always required.
Configure scoring through Settings → Load scoring policy JSON, starting with samsara/assets/scoring_policy.json. The applied policy and exact per-workload score explanation are recorded in JSON and HTML; history keeps its original policy. See scoring rules, limitations and regression scenarios.
To re-score the test server without contacting it again, restart Samsara and open its previous JSON inventory or assessment using Saved inventory file. Existing v1 raw inventory is compatible; old scores are ignored and recomputed. The saved timestamp/source remain explicit. The original report JSON was not provided for development, so the 1,565-point regression uses synthetic data matching the reported counts.
HTML now summarizes actionable findings and confidence rather than dumping hundreds of services. Each HTML export creates a linked, content-addressed inventory JSON file beside it. Keep both files together; the JSON assessment export also retains all inventory. Every routine service, feature, administrative share and connection remains available in the detailed UI tabs and full JSON.
Headless Linux inventory
The standard-library-only collector can export local inventory without Qt:
python3 -m samsara.collectors.linux --output /tmp/server-inventory.json
Use a new filename; existing files are not overwritten. Open the result using Saved inventory file on either desktop. Imported check assertions are not independently verified. Import validates the v1 schema, limits input to 10 MiB, removes external diagnostic details and service/task command fields, and recalculates risk.
Development
python -m unittest discover -s tests -v
Qt tests run offscreen. See platform support, architecture and plan and developer guide. Run from source; Windows packaging and real-host collector acceptance remain pending. PowerShell AST/synthetic tests run when a native runtime is available and are explicitly skipped otherwise. On this Linux development host, 61 tests were discovered: 60 passed and the native PowerShell test was skipped; no real Windows inventory has been collected.