Oninit® Snooper — For the Solution Architect

Most observability stories for Informix are either invasive (server tracing with attendant operational risk and overhead) or opaque (packet capture with no protocol awareness). Oninit® Snooper is a third option: a transparent, read-only TCP forwarder that decodes the SQLI wire protocol in real time and emits a stable structured event stream.

Architectural shape

A small process accepting client connections on --listen, opening a paired upstream connection per session to --upstream, forwarding bytes on a plain read() / write() loop, with a parallel reader walking each direction's stream into PFPDU events. Three pthreads per connection — one forwarder per direction plus a per-connection logger draining a 256 KiB ring buffer — coordinated through a small shared state struct for cross-direction timing. Decode work is kept off the forwarding path, so the latency added is sub-millisecond per PFPDU plus one extra TCP hop.

A stable contract for downstream tooling

Output is a fixed 10-column TSV, one line per PFPDU. Tabs and newlines inside fields are escaped to \t / \n, so there's no quoting layer to defeat shell tools or log shippers. Downstream consumers — SIEM ingest, log-platform pipelines, ad-hoc analysis — don't need a custom parser. cut -f, awk -F'\t', Perl -F'\t', and standard shipper plugins all work as-is.

Time you can actually compute with

Deployment properties that matter at scale

• Single statically linked, stripped ~1 MB binary. No CSDK, no libifsql, no shared library on the deployment host. It runs on whatever Linux you have.
• No changes to sqlhosts, onconfig, the client, or the server.
• Read-only by construction — never modifies bytes, never injects PFPDUs, and never blocks the forwarder on its own work.
• Capture-all by default, with an optional inline token whitelist (--only=A,B,...) applied after timing-state updates so latency rollups still measure the full stream.
• Output to --out FILE (append mode, line-flushed) or stderr; pair with logrotate for long-running observation.

Where it fits in the target architecture

Vendor and lock-in posture

The output is a documented TSV schema. The binary is built on commodity Linux and runs without IBM dependencies on the deployment host. There is no agent fleet, no central server, no licensing of decoded fields, and no proprietary dashboard the operator is forced to use. If the team later moves the same data into a different observability backend, the existing TSV is the export.

Next step: a one-hour scoping call to map the snoop into the target architecture for one workload. Email support@oninit.com.

The bigger picture

If you really understand what Snooper does, you realize it fundamentally changes how Informix applications can be deployed.

It allows existing Informix applications to run against any database without modification. By decoupling legacy systems from their original data layer, it removes the need for costly rewrites and enables safe, phased modernization. Organizations can preserve proven application logic while moving data and infrastructure forward—reducing risk, cost, and disruption.