Point gumshoe at a MySQL, PostgreSQL, or Neo4j database and it runs safe, cheap, read-only diagnostic queries in the background — hunting misconfigurations, slow and blocked queries, lock contention, connection saturation, and missing or unused indexes. Findings are attributed to a user, host, and query, and stored locally so an incident can be reviewed after the fact.
Every check is built to be run against a live, real database without adding to the incident.
Every query reads system catalogs, SHOW commands, or admin procedures only — never user tables, never EXPLAIN ANALYZE.
Read-only transaction mode, short statement timeouts (3s), and a tagged application_name so DBAs can identify gumshoe on sight.
Every check declares free, cheap, or moderate — controlling how often it runs while watching.
Query text is stripped of literals before storage or display — raw user data never leaves the server.
Version differences are probed at connect — only checks that engine and version actually support run.
| Engine | Versions | Hardening |
|---|---|---|
| MySQL | 5.7, 8.0, 8.4 | transaction_read_only, max_execution_time=3000 |
| PostgreSQL | 13, 15, 17 | default_transaction_read_only, statement_timeout=3s, lock_timeout=500ms |
| Neo4j | 4.4, 5.x | Read access mode, 3s transaction timeout |
checkOne-shot diagnosis. Findings sorted worst-first, attributed to user/host/query. Exit code 1 at warning+, so it drops straight into a runbook script.
watchLive TUI dashboard — overview, activity, findings, and lock chains, sampled on an interval and stored for later review.
serveLocal web UI at 127.0.0.1:8086. Same live pages as watch, browsable from anywhere on your machine.
reportReview stored sessions after the fact — export a Markdown postmortem straight from a stored incident.
Long-running queries and blocked sessions come first, each attributed to a real user and host.
gumshoe check --profile prod
Which query shapes dominate, who's blocking whom — quit when done and the session is stored.
gumshoe watch --profile prod
Blocking chains collapse to one finding per root blocker, with every downstream waiter listed.
gumshoe check --category locks
Tables scanned without indexes, and indexes that cost writes but serve no reads.
gumshoe check --category indexes
Install the binary
curl -fsSL https://raw.githubusercontent.com/AxeForging/gumshoe/main/install.sh | shSave a profile — gumshoe profile add --name prod --engine postgres --host db.internal --user debug
Run a check — gumshoe check --profile prod