membrane wraps a process and keeps what it did: terminal bytes, decrypted https, libc
calls, dns, subprocesses. one stream of structured events, in a sqlite file.
a log has what you thought to log. a capture has the rest — the env var a dependency read
at import, the file it wrote to /tmp, the request your agent made while you were looking
somewhere else. you don't have to know what you're looking for before you run it.
$ curl -fsSL https://membrane-systems.com/install.sh | MEMBRANE_KEY=<key> MEMBRANE_VERSION=3f510d019672 sh
$ membrane wrap -t all -s sqlite=run.db -- your-command
$ sqlite3 run.db "select category,
json_extract(payload, '$.type') as type, count(*)
from events group by 1, 2 order by 3 desc"