Oninit® Snooper — For the DBA

You already know how this goes. The application team says it's slow. The server stats look fine. onstat -g sql truncates the statement you actually want to see. tcpdump gives you bytes you can't read. Server tracing either isn't on or is so noisy it's useless. Meanwhile somebody's on the bridge waiting for an answer.

oni_snoop is the tool that closes that gap. It's a SQLI-aware passthrough proxy: clients connect to it, it forwards every byte verbatim to the real IDS, and in parallel it decodes every PFPDU in both directions and writes a line-per-PFPDU TSV log.

What you get on a hot incident

What you don't have to set up

• No sqlhosts edits. Point --listen at the address the client already uses; point --upstream at the real IDS.
• No onconfig changes. No IDS restart. No client rebuild.
• No CSDK on the host running the snoop. It's a single statically linked, stripped ~1 MB binary — no libifsql.so, no glibc-version constraints.
• No application instrumentation. The application doesn't know the snoop is there.

What it deliberately doesn't do

• It does not modify bytes in either direction. Read-only by construction.
• It does not inject PFPDUs.
• It does not block the forwarder on its own decode work — bytes leave the wire before any parsing happens; each connection has its own 256 KiB ring buffer and a dedicated logger pthread.
• It does not desync. Unknown tokens log one line and resync at the next ONI_EOT.

Output you can already grep

Fixed 10-column TSV, one line per PFPDU. Tabs and newlines inside fields are escaped to \t / \n, so cut -f, awk -F'\t', and Perl -F'\t' all work as-is. No custom parser, no Wireshark plugin, no server trace dump. The schema is the contract; new information lands in the existing summary column or in tagged comment lines.

Drop it on a test environment this week. Email support@oninit.com or call +1 913 732 8892 to get the binary and a short README of the two flags that matter: --listen and --upstream.

The bigger picture

If you really understand what Snooper does, you realize it fundamentally changes how Informix applications can be deployed.

It allows existing Informix applications to run against any database without modification. By decoupling legacy systems from their original data layer, it removes the need for costly rewrites and enables safe, phased modernization. Organizations can preserve proven application logic while moving data and infrastructure forward—reducing risk, cost, and disruption.