wtf is ltm?

ltm is a tool for Linux that keeps a searchable history of what happened on your machine, so you can go back later and figure out what a process, file, or network connection did and when. Think of it as a black box recorder for your computer: it quietly watches activity in the background, then lets you ask questions about the past instead of guessing. Under the hood it uses a Linux kernel feature called eBPF to record around sixty different kinds of system events: processes starting and stopping, files being opened, read, written, renamed, or deleted, memory being mapped, network sockets connecting or listening, and disk activity. All of this is saved as metadata, not actual file contents, into a local SQLite database. Once you have started recording, you can explore the results several ways. A timeline command lets you filter events by process, user, file path, program name, or time window. A watch command tails events live, similar to following a log file. A diff command shows what changed on the machine between two points in time. There is also a plain English query mode, where you can ask something like which process wrote to files the most today, and ltm either matches it to a built in template or, if you configure an AI agent such as Claude or Codex, translates it into a safe, read only SQL query for you. Recording requires root access or specific Linux capabilities and only works on 64 bit Intel and AMD machines. Querying the recorded data does not need root, and if you do not have a live recording set up, a benchmark command can generate fake sample events so you can try out the timeline and query features anyway. The project currently only decodes IPv4 network addresses, and some byte counts and file descriptor mappings can be approximate under heavy load. It is written in Go and is aimed at developers and system administrators who want to debug or audit what actually happened on a Linux machine.