CustomOS3.1 OBSIDIAN
Event viewer
Sample events from auditd, AIDE, Suricata, nftables and the updater. Signed / hash-chained logs: roadmap.
| Cat | Source | Event |
|---|---|---|
| SEC | auditd | privileged command executed (audited) |
| NET | nft | inbound packet dropped by the default-deny policy |
| SEC | aide | integrity check: changes against the baseline are reported |
| NET | suricata | IDS rules loaded (local rules, plus managed rules if opted in) |
| SEC | login | interactive session started (lightdm) |
| SEC | updater | manifest signature (Ed25519, TUF) and anti-rollback checked before any update |
| KRN | boot | Secure Boot chain verified; kernel lockdown mode active |
| KRN | verity | /usr read-only and verified by dm-verity when block verity is enabled |