rpert/log_analysis
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial cross-server log inventory + anomaly scan

Browse Source 
- 10 hosts (mo1, ams, ams2, ro1, ca1, ca2, ca3, fr1, sony, termux)
- discover-logs.sh: portable inventory (Linux/FreeBSD/Termux)
- scan-anomalies.sh: ERROR/WARN/CRITICAL counts + journalctl + kubectl
- run-all.sh: parallel SSH fan-out
- build-summary.py: aggregates into reports/SUMMARY.md
- 5 HIGH-severity findings identified on ro1 (apache scanner traffic, mount_monitor warnings)
This commit is contained in:
rpert
2026-04-10 21:49:17 +00:00
parent cabf4c587f
commit e96a8b03fc
26 changed files with 1636 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
anomalies/ams.txt Normal file
View File

@@ -0,0 +1,31 @@
=== Anomaly scan: ams.3z8.pw (2026-04-10T21:46:07Z) ===
--- recent log files (mtime < 7d) ---
/var/log/borg-backup.log errors=21 warns=0 size=6198346
> M /usr/local/www/apache24/error/HTTP_INTERNAL_SERVER_ERROR.html.var
> M /usr/local/www/apache24/error/HTTP_PRECONDITION_FAILED.html.var
> [2026-03-12 02:00:01] BACKUP FAILED with exit code 2
> [2026-03-13 02:00:01] BACKUP FAILED with exit code 2
> [2026-03-14 02:00:01] BACKUP FAILED with exit code 2
/var/log/debug.log.0.bz2 errors=1 warns=0 size=55238
> Binary file (standard input) matches
--- /var/log disk usage ---
13M /var/log
92K /var/log/maillog.4.bz2
96K /var/log/maillog.3.bz2
104K /var/log/maillog.6.bz2
108K /var/log/maillog.2.bz2
120K /var/log/debug.log
120K /var/log/maillog.1.bz2
124K /var/log/maillog.0.bz2
340K /var/log/cron
344K /var/log/messages
512K /var/log/bsdinstall_log
512K /var/log/utx.log.1
672K /var/log/auth.log
928K /var/log/letsencrypt
1.3M /var/log/maillog
6.0M /var/log/borg-backup.log
--- top 15 largest files under /var/log ---

25
anomalies/ams2.txt Normal file
View File

@@ -0,0 +1,25 @@
=== Anomaly scan: ams2.3z8.pw (2026-04-10T21:45:59Z) ===
--- recent log files (mtime < 7d) ---
/var/log/borg/cron.log errors=1 warns=0 size=265522
> M /etc/periodic/security/520.pfdenied
--- /var/log disk usage ---
7.7M /var/log
68K /var/log/auth.log.6.bz2
72K /var/log/auth.log.0.bz2
72K /var/log/auth.log.3.bz2
72K /var/log/auth.log.4.bz2
72K /var/log/auth.log.5.bz2
76K /var/log/bsdinstall_log
84K /var/log/maillog.2.bz2
160K /var/log/cron
628K /var/log/borg
640K /var/log/maillog
672K /var/log/debug.log
704K /var/log/auth.log
704K /var/log/daemon.log
704K /var/log/messages
1.6M /var/log/letsencrypt
--- top 15 largest files under /var/log ---

41
anomalies/ca1.txt Normal file
View File

@@ -0,0 +1,41 @@
=== Anomaly scan: ca1.rspworks.tech (2026-04-10T21:46:10Z) ===
--- journalctl -p err --since '24 hours ago' ---
-- No entries --
--- recent log files (mtime < 7d) ---
--- /var/log disk usage ---
372M /var/log
852K /var/log/ufw.log.2.gz
1.3M /var/log/syslog.3.gz
1.4M /var/log/syslog.2.gz
1.6M /var/log/auth.log
1.7M /var/log/mail.log
3.4M /var/log/auth.log.1
6.1M /var/log/kern.log
6.1M /var/log/sysstat
6.1M /var/log/ufw.log
7.3M /var/log/ufw.log.1
7.4M /var/log/kern.log.1
7.9M /var/log/btmp.1
8.7M /var/log/syslog
9.5M /var/log/syslog.1
296M /var/log/journal
--- top 15 largest files under /var/log ---
440136579 /var/log
360710144 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8
360710144 /var/log/journal
58720256 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/system@ab13cdfa37454491a79434767401386e-00000000003adb5c-00064cb3c1ed363d.journal
58720256 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/system@9e6ecb5b9f514c72a5570e68825ad6a7-00000000003ca351-00064d43484e2748.journal
50331648 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/system@fec4a914b99c4953ab02aad708666ef9-00000000003f6f27-00064e81484ba094.journal
50331648 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/system@9e6ecb5b9f514c72a5570e68825ad6a7-00000000003defff-00064ddfb0de2946.journal
25165824 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/system@9e6ecb5b9f514c72a5570e68825ad6a7-00000000003f15ad-00064e58095423d3.journal
25165824 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/system@00064d3b8778fc5f-b4dcd1bdd4b96ecb.journal~
9868554 /var/log/syslog.1
9053714 /var/log/syslog
8388608 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/user-1000.journal
8388608 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/user-1000@fec4a914b99c4953ab02aad708666ef9-00000000003f6f26-00064e81484b121d.journal
8388608 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/user-1000@ab13cdfa37454491a79434767401386e-00000000003c27c9-00064d143295a90c.journal
8388608 /var/log/journal/6f9b28a107671d35d565db8d4fdf10a8/user-1000@ab13cdfa37454491a79434767401386e-00000000003afdc3-00064cc380be60fc.journal

41
anomalies/ca2.txt Normal file
View File

@@ -0,0 +1,41 @@
=== Anomaly scan: ip-51-79-3-199 (2026-04-10T21:46:10Z) ===
--- journalctl -p err --since '24 hours ago' ---
-- No entries --
--- recent log files (mtime < 7d) ---
--- /var/log disk usage ---
463M /var/log
532K /var/log/syslog.3.gz
576K /var/log/ufw.log.4.gz
844K /var/log/auth.log.3.gz
1.1M /var/log/kern.log.3.gz
1.1M /var/log/kern.log.4.gz
1.1M /var/log/syslog.4.gz
1.1M /var/log/ufw.log.2.gz
1.1M /var/log/ufw.log.3.gz
1.2M /var/log/btmp
1.6M /var/log/auth.log
1.6M /var/log/auth.log.4.gz
3.3M /var/log/auth.log.1
3.8M /var/log/ufw.log.1
33M /var/log/btmp.1
409M /var/log/journal
--- top 15 largest files under /var/log ---
485391370 /var/log
428663992 /var/log/journal
428659896 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6
45110984 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-00000000000292e8-00064c3d93bf6cf5.journal
44732968 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-0000000000037922-00064c84af763c31.journal
44467312 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-0000000000053500-00064d0111ffd3c7.journal
44453136 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-0000000000045881-00064cc7fd5e30a1.journal
43759864 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-0000000000000be2-00064b9f844d6876.journal
43717416 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-000000000001be8a-00064bffa0a97a8a.journal
43173456 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-000000000000eb50-00064bcebd787df5.journal
41980912 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system@86c54d3ff5d441bb8055b2ee8b5a63e9-00000000000612ff-00064d4e811ecc56.journal
34127232 /var/log/btmp.1
25165824 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/system.journal
8388608 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/user-1001.journal
4543296 /var/log/journal/b02dc037a34a4cb8a15b01d75132a0f6/user-1001@de6260ca127840deab7e231baa6cfc8a-000000000006158d-00064d54160e10b6.journal

42
anomalies/ca3.txt Normal file
View File

@@ -0,0 +1,42 @@
=== Anomaly scan: ca3.3z8.pw (2026-04-10T21:46:10Z) ===
--- journalctl -p err --since '24 hours ago' ---
-- Journal begins at Sat 2026-03-21 16:10:27 UTC, ends at Fri 2026-04-10 21:46:10 UTC. --
-- No entries --
--- recent log files (mtime < 7d) ---
--- /var/log disk usage ---
41M /var/log
0 /var/log/btmp
4.0K /var/log/auth.log
4.0K /var/log/debug
4.0K /var/log/messages
4.0K /var/log/private
8.0K /var/log/alternatives.log
8.0K /var/log/faillog
8.0K /var/log/lastlog
8.0K /var/log/runit
12K /var/log/wtmp
28K /var/log/daemon.log
32K /var/log/syslog
100K /var/log/apt
136K /var/log/dpkg.log
41M /var/log/journal
--- top 15 largest files under /var/log ---
42593888 /var/log
41951232 /var/log/journal
41947136 /var/log/journal/55590223568e4ab1b9338e2426cfb245
25165824 /var/log/journal/55590223568e4ab1b9338e2426cfb245/system.journal
8388608 /var/log/journal/55590223568e4ab1b9338e2426cfb245/user-1000.journal
8388608 /var/log/journal/55590223568e4ab1b9338e2426cfb245/system@83232735e3e24ff5ace21763d35e7781-0000000000000001-000610a6d481f748.journal
292292 /var/log/lastlog
137512 /var/log/dpkg.log
91195 /var/log/apt
63092 /var/log/apt/term.log
32032 /var/log/faillog
28775 /var/log/syslog
28345 /var/log/daemon.log
12428 /var/log/apt/eipp.log.xz
11579 /var/log/apt/history.log

43
anomalies/fr1.txt Normal file
View File

@@ -0,0 +1,43 @@
=== Anomaly scan: fr1.3z8.pw (2026-04-10T21:46:42Z) ===
--- journalctl -p err --since '24 hours ago' ---
-- No entries --
--- kubectl get events --all-namespaces (warnings) ---
--- recent log files (mtime < 7d) ---
--- /var/log disk usage ---
2.3G /var/log
2.3M /var/log/mail.log.1
2.4M /var/log/borg-backup.log
2.8M /var/log/borg
2.9M /var/log/syslog.3.gz
3.0M /var/log/auth.log.1
3.8M /var/log/syslog.2.gz
5.2M /var/log/postfix.log
6.1M /var/log/kern.log
6.1M /var/log/ufw.log
7.3M /var/log/ufw.log.1
7.4M /var/log/kern.log.1
13M /var/log/btmp.1
38M /var/log/syslog
47M /var/log/syslog.1
2.2G /var/log/journal
--- top 15 largest files under /var/log ---
2424100146 /var/log
2256551936 /var/log/journal
2256547840 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-0000000000a63802-00064ee25f15ebf5.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-0000000000a486e1-00064ebf45be6c08.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-0000000000a2d51d-00064e9ca8d04650.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-0000000000a11a97-00064e79b0d30b2f.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-00000000009f4c9f-00064e56b4e1c853.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-00000000009d71f8-00064e33e5548a49.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-00000000009ba218-00064e112c8993aa.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-000000000099c686-00064def3633af5b.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-000000000097e720-00064dcc67deca0d.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-0000000000961320-00064da9dc769b56.journal
125829120 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/user-1000@27dcfd2fef7244188c973786553a5804-0000000000941583-00064d8712b97fc5.journal
109051904 /var/log/journal/7a3fd67a924c4186bb3081ae4975373c/system@32d91142d7d0427bb5e4c170c7a73604-0000000000917d56-00064d56478ea870.journal

79
anomalies/mo1.txt Normal file
View File

@@ -0,0 +1,79 @@
=== Anomaly scan: mo1.3z8.pw (2026-04-10T21:46:10Z) ===
--- journalctl -p err --since '24 hours ago' ---
Apr 09 23:02:18 mo1.3z8.pw sudo[1989355]: pam_unix(sudo:auth): conversation failed
Apr 09 23:02:18 mo1.3z8.pw sudo[1989355]: pam_unix(sudo:auth): auth could not identify password for [rpert]
Apr 09 23:16:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 09 23:33:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 09 23:59:51 mo1.3z8.pw sudo[4140045]: pam_unix(sudo:auth): conversation failed
Apr 09 23:59:51 mo1.3z8.pw sudo[4140045]: pam_unix(sudo:auth): auth could not identify password for [rpert]
Apr 10 00:02:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 00:49:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 01:00:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 01:05:16 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 01:10:33 mo1.3z8.pw sudo[2570337]: pam_unix(sudo:auth): conversation failed
Apr 10 01:10:33 mo1.3z8.pw sudo[2570337]: pam_unix(sudo:auth): auth could not identify password for [rpert]
Apr 10 02:16:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 03:51:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 04:08:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 05:01:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 05:36:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 05:59:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 07:19:31 mo1.3z8.pw sudo[3980992]: pam_unix(sudo:auth): conversation failed
Apr 10 07:19:31 mo1.3z8.pw sudo[3980992]: pam_unix(sudo:auth): auth could not identify password for [rpert]
Apr 10 09:52:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 10:21:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 10:56:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 11:07:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 11:42:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 12:11:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 12:16:16 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 12:57:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 13:08:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 13:13:16 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 13:36:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 13:41:16 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 14:34:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 14:39:16 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 15:14:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 15:31:15 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
Apr 10 15:36:16 mo1.3z8.pw systemd[11617]: Failed to start mbsync.service - Mailbox synchronization (mbsync).
--- kubectl get events --all-namespaces (warnings) ---
--- recent log files (mtime < 7d) ---
--- /var/log disk usage ---
822M /var/log
524K /var/log/kern.log.1
600K /var/log/auth.log.2.gz
908K /var/log/auth.log.3.gz
1016K /var/log/btmp
1.1M /var/log/auth.log.4.gz
1.5M /var/log/syslog.4.gz
2.3M /var/log/auth.log
3.0M /var/log/syslog.2.gz
4.3M /var/log/auth.log.1
6.9M /var/log/syslog.3.gz
18M /var/log/rclone-media.log
23M /var/log/btmp.1
39M /var/log/syslog.1
65M /var/log/syslog
655M /var/log/journal
--- top 15 largest files under /var/log ---
916304891 /var/log
740593040 /var/log/journal
740588944 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4
128611656 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/system@988ab89fd22f4f208176d25bc2f2470d-0000000000074a21-00064d0e5525584b.journal
109051904 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/system.journal
75985176 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/system@988ab89fd22f4f208176d25bc2f2470d-000000000013e463-00064e5f5e0e5175.journal
74216752 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/system@988ab89fd22f4f208176d25bc2f2470d-000000000010fac9-00064e02e1bb1c0d.journal
70106232 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/system@988ab89fd22f4f208176d25bc2f2470d-00000000000db4af-00064d7f051b8ba1.journal
67501427 /var/log/syslog
58720256 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/system@00064d7ec2d5b400-62e4a0e0b73c867c.journal~
46971424 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/user-1001@01eac76beb704389b4f9ca118b11b2f8-00000000000db4ec-00064d7f051d3e37.journal
45807768 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/user-1001@01eac76beb704389b4f9ca118b11b2f8-000000000013e47d-00064e5f64861672.journal
40099593 /var/log/syslog.1
28811960 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/user-1001@01eac76beb704389b4f9ca118b11b2f8-000000000010fad6-00064e02e39cd4e3.journal
25165824 /var/log/journal/a9f1f6828f9a4d60a85e1079cc2c6bc4/user-1001@00064d7ec2f1014e-21c53d09549b2cc2.journal~

65
anomalies/ro1.txt Normal file
View File

@@ -0,0 +1,65 @@
=== Anomaly scan: ro1-3z8-pw.novalocal (2026-04-10T21:46:09Z) ===
--- recent log files (mtime < 7d) ---
/var/log/borg-backup.log errors=5 warns=0 size=13318316
> M /usr/local/www/apache24/error/HTTP_INTERNAL_SERVER_ERROR.html.var
> M /usr/local/www/apache24/error/HTTP_PRECONDITION_FAILED.html.var
> M /usr/local/www/apache24/error/HTTP_INTERNAL_SERVER_ERROR.html.var
> M /usr/local/www/apache24/error/HTTP_PRECONDITION_FAILED.html.var
> M /usr/local/www/i47i.tk/wp-content/plugins/redis-cache/dependencies/predis/predis/src/Command/Redis/FAILOVER.php
/var/log/freedns-ssl-error.log errors=72 warns=0 size=1343992
> [Thu Mar 19 17:06:45.696498 2026] [authz_core:error] [pid 59340] [client 20.151.11.236:41914] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin
> [Sat Mar 21 05:45:17.976155 2026] [authz_core:error] [pid 97472] [client 20.151.11.236:31811] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin
> [Sat Mar 21 06:41:09.566838 2026] [authz_core:error] [pid 69202] [client 172.235.235.248:54732] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin
> [Sun Mar 22 03:00:13.267508 2026] [authz_core:error] [pid 9998] [client 185.177.72.52:18966] AH01630: client denied by server configuration: /usr/local/www/freedns-placeholder/.htaccess
> [Sun Mar 22 03:00:13.502429 2026] [authz_core:error] [pid 69202] [client 185.177.72.52:18982] AH01630: client denied by server configuration: /usr/local/www/freedns-placeholder/.htaccess
/var/log/httpd/i47i.tk-error.log errors=51 warns=0 size=400820
> [Thu Mar 19 18:50:37.024880 2026] [authz_core:error] [pid 59307] [client 20.222.18.47:21485] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin
> [Fri Mar 20 11:42:47.077024 2026] [authz_core:error] [pid 69861] [client 23.100.100.188:3532] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin
> [Tue Mar 24 23:57:24.319230 2026] [authz_core:error] [pid 81828] [client 85.203.23.121:52441] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin, referer: http://i47i.tk/cgi-bin/cgi-bin/sql.php
> [Wed Mar 25 02:04:05.820795 2026] [authz_core:error] [pid 81829] [client 20.222.18.47:22936] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin
> [Wed Mar 25 18:35:40.714323 2026] [authz_core:error] [pid 32775] [client 20.151.201.236:22849] AH01630: client denied by server configuration: /usr/local/www/apache24/cgi-bin
/var/log/manual-upgrades/upgrade-2026-04-05_0400.log errors=3 warns=0 size=2495
> Warning: Failed to create directory '/nonexistent/.wp-cli/cache/': mkdir(): Permission denied.
> FAILED: apache24 php_fpm jellyfin flood redis
> {"id":"ZAa6Ntdv1W5c","time":1775361630,"expires":1775404830,"event":"message","topic":"rspworks-updates","title":"Manual Upgrade ERRORS — ro1-3z8-pw.novalocal","message":"1 services running\n\nUpdated:\\n• WordPress: 3 plugins\n\nErrors:\\n• Service down: apache24\\n• Service down: php_fpm\\n• Service down: jellyfin\\n• Service down: flood\\n• Service down: redis","priority":4,"tags":["warning","package"]}
/var/log/messages errors=0 warns=886 size=512303
/var/log/mount_monitor.log errors=0 warns=1808 size=526613
/var/log/mount_monitor.log.old errors=7 warns=3614 size=1048798
> [2026-03-24 13:05:30] CRITICAL: Mount is hung (ls command timed out)
> [2026-03-24 13:06:28] FAILED: Mount still not responding after recovery attempt
> [2026-03-24 13:10:30] CRITICAL: Mount is hung (ls command timed out)
> [2026-03-24 13:11:28] FAILED: Mount still not responding after recovery attempt
> [2026-03-24 13:15:35] CRITICAL: Mount is hung (ls command timed out)
/var/log/rclone_1fichier.log errors=6 warns=0 size=3527222
> 2026/03/24 13:06:28 ERROR : IO error: couldn't list files: Post "https://api.1fichier.com/v1/file/ls.cgi": dial tcp: lookup api.1fichier.com: i/o timeout
> 2026/03/24 13:10:30 ERROR : IO error: couldn't list files: Post "https://api.1fichier.com/v1/file/ls.cgi": dial tcp: lookup api.1fichier.com: i/o timeout
> 2026/03/24 13:11:28 ERROR : IO error: couldn't list files: Post "https://api.1fichier.com/v1/file/ls.cgi": dial tcp 5.39.224.140:443: i/o timeout
> 2026/03/24 13:15:35 ERROR : IO error: couldn't list files: Post "https://api.1fichier.com/v1/file/ls.cgi": net/http: TLS handshake timeout
> 2026/03/30 06:45:30 ERROR : IO error: couldn't list files: Post "https://api.1fichier.com/v1/file/ls.cgi": dial tcp 5.39.224.140:443: i/o timeout
/var/log/webmail-ssl-error.log errors=62 warns=0 size=28197
> [Fri Jan 09 22:57:32.624107 2026] [authz_core:error] [pid 67028] [client 146.19.168.250:51646] AH01630: client denied by server configuration: /usr/local/www/roundcube/config/.env
> [Fri Jan 09 22:57:45.572560 2026] [authz_core:error] [pid 67028] [client 146.19.168.250:51646] AH01630: client denied by server configuration: /usr/local/www/roundcube/config/config.php
> [Fri Jan 09 22:57:47.072687 2026] [authz_core:error] [pid 67028] [client 146.19.168.250:51646] AH01630: client denied by server configuration: /usr/local/www/roundcube/config/database.php
> [Fri Jan 09 22:57:47.392299 2026] [authz_core:error] [pid 67028] [client 146.19.168.250:51646] AH01630: client denied by server configuration: /usr/local/www/roundcube/config/mail.php
> [Fri Jan 09 22:57:47.693547 2026] [authz_core:error] [pid 67028] [client 146.19.168.250:51646] AH01630: client denied by server configuration: /usr/local/www/roundcube/config/app.php
--- /var/log disk usage ---
95M /var/log
960K /var/log/httpd-nextcloud-access.log
1.1M /var/log/mount_monitor.log.old
1.3M /var/log/freedns-ssl-error.log
1.9M /var/log/freedns-access.log
2.2M /var/log/matomo-access.log
2.6M /var/log/flood.log
3.3M /var/log/httpd-access.log
3.4M /var/log/rclone_1fichier.log
4.3M /var/log/freedns-ssl-access.log
5.6M /var/log/httpd-error.log
6.2M /var/log/redis
9.3M /var/log/letsencrypt
9.8M /var/log/httpd
13M /var/log/borg-backup.log
24M /var/log/webmail-ssl-access.log
--- top 15 largest files under /var/log ---

140
anomalies/sony.txt Normal file
View File

@@ -0,0 +1,140 @@
=== Anomaly scan: sony (2026-04-10T21:50:12Z) ===
--- journalctl -p err --since '24 hours ago' ---
Apr 10 19:24:30 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:24:30 sony kwin_wayland[1565]: pw.core: 0x5608ecf12a10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:24:31 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:24:31 sony kwin_wayland[1565]: pw.core: 0x5608ecf12a10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:24:35 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:24:35 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:24:56 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:24:56 sony kwin_wayland[1565]: pw.core: 0x5608ecdcca70: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:25:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:25:00 sony kwin_wayland[1565]: pw.core: 0x5608ecedaee0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:25:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:25:00 sony kwin_wayland[1565]: pw.core: 0x5608ecedaee0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:01 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:01 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:01 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:01 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:21 sony kwin_wayland[1565]: pw.core: 0x5608ecf12a10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:28:21 sony kwin_wayland[1565]: pw.core: 0x5608ecf12a10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:29:23 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:29:23 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:29:24 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:29:24 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:30:29 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:31:40 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:31:40 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:31:41 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:31:41 sony kwin_wayland[1565]: pw.core: 0x5608eca68270: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:34:48 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:34:48 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:34:48 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:34:48 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:34:48 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:34:49 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:34:49 sony kwin_wayland[1565]: pw.core: 0x5608eccde2f0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:35:03 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:35:03 sony kwin_wayland[1565]: pw.core: 0x5608eca8c330: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:35:03 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:35:04 sony kwin_wayland[1565]: pw.core: 0x5608ec94dd90: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:35:04 sony kwin_wayland[1565]: pw.core: 0x5608eca8e7a0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:38:28 sony kwin_wayland[1565]: pw.core: 0x5608eca8e7a0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:38:28 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:58:55 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 19:58:55 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:03:51 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:03:51 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:03:51 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:10:56 sony kwin_wayland[1565]: pw.core: 0x5608eca8e7a0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:10:56 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:10:56 sony kwin_wayland[1565]: pw.core: 0x5608eca8e7a0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:25 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:25 sony kwin_wayland[1565]: pw.core: 0x5608eca5f490: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:25 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:25 sony kwin_wayland[1565]: pw.core: 0x5608eca5f490: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:26 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:26 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:34 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:34 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:34 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:34 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:34 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:34 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:35 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:53 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:53 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:56 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:12:56 sony kwin_wayland[1565]: pw.core: 0x5608ecedaee0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:37 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:37 sony kwin_wayland[1565]: pw.core: 0x5608ecedaee0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:37 sony kwin_wayland[1565]: pw.core: 0x5608eca89820: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:37 sony kwin_wayland[1565]: pw.core: 0x5608eca98ff0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:37 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:38 sony kwin_wayland[1565]: pw.core: 0x5608ecedaee0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:38 sony kwin_wayland[1565]: pw.core: 0x5608eca89820: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:38 sony kwin_wayland[1565]: pw.core: 0x5608eca98ff0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:38 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:38 sony kwin_wayland[1565]: pw.core: 0x5608ecedaee0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:38 sony kwin_wayland[1565]: pw.core: 0x5608eca89820: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:14:38 sony kwin_wayland[1565]: pw.core: 0x5608eca98ff0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:18:30 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:18:30 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:18:30 sony kwin_wayland[1565]: pw.core: 0x5608eca89820: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:18:30 sony kwin_wayland[1565]: pw.core: 0x5608ecedaee0: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:00 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:00 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:00 sony kwin_wayland[1565]: pw.core: 0x5608eca89820: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:00 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:00 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:00 sony kwin_wayland[1565]: pw.core: 0x5608ec42fb10: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:01 sony kwin_wayland[1565]: pw.core: 0x5608eca5f490: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:01 sony kwin_wayland[1565]: pw.core: 0x5608eca89820: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:10 sony kwin_wayland[1565]: pw.core: 0x5608eccbd420: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:10 sony kwin_wayland[1565]: pw.core: 0x5608ec77a790: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:10 sony kwin_wayland[1565]: pw.core: 0x5608ec9faf80: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 20:19:10 sony kwin_wayland[1565]: pw.core: 0x5608eca5f490: can't find protocol 'PipeWire:Protocol:Native': Operation not supported
Apr 10 21:29:28 sony pulseaudio[2074]: listen(): Address already in use
--- recent log files (mtime < 7d) ---
--- /var/log disk usage ---
975M /var/log
44K /var/log/Xorg.4.log
48K /var/log/Xorg.0.log
48K /var/log/Xorg.2.log.old
52K /var/log/Xorg.2.log
64K /var/log/cups
80K /var/log/dpkg.log
176K /var/log/dpkg.log.1
328K /var/log/apt
348K /var/log/wtmp
5.2M /var/log/borg
8.0M /var/log/sysstat
16M /var/log/installer
22M /var/log/btmp.1
43M /var/log/btmp
881M /var/log/journal
--- top 15 largest files under /var/log ---
1044955349 /var/log
946458048 /var/log/journal
946453952 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191
88073456 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000a34940-00064d26d0195621.journal
63504120 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000a69958-00064d5ff691b4bf.journal
62967088 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000af4d40-00064e327ccda35d.journal
61736360 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000a8de97-00064d86d8f9bd3e.journal
61211680 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000ad27b8-00064df90e8ad1b4.journal
59695360 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000aaf970-00064db69212e347.journal
52503040 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000b998d6-00064ef8d98ae458.journal
51122088 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000b19523-00064e6770b00a37.journal
48994704 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000b6e73c-00064ecb4656be5a.journal
48922288 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000b310e6-00064e88c632bfd4.journal
48506288 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000b84345-00064ee40729abfa.journal
48217128 /var/log/journal/d6ca70e2890c410d83487a70a6f3f191/system@3535f37826724a348121d0df1b9e4792-0000000000b45d3b-00064ea125adf352.journal

7
anomalies/termux.txt Normal file
View File

@@ -0,0 +1,7 @@
=== Anomaly scan: localhost (2026-04-10T21:46:49Z) ===
--- recent log files (mtime < 7d) ---
--- /var/log disk usage ---
--- top 15 largest files under /var/log ---