Everyday
Events
What happened, and who asked for it.
The feed
- A live activity feed driven by the daemon's own event stream, with relative timestamps.
- Filters by host and by outcome.
- Called Activity until 0.1.7; the old path still redirects.
The audit trail
- Every audited action records the user who performed it.
- The entry is written before the action runs and updated with its outcome, so an action that crashed the process still left evidence it was requested.
- That ordering is deliberate: a log that only records successes is not an audit trail.
Air-gapped
- Written and read locally. Nothing is shipped anywhere for you to retrieve later.