Wazuh

Four commits to the lab repo, all about the same problem: telling a real alert apart from a chatty log line.

Wiring Wazuh, Ceph, and Uptime Kuma into Telegram surfaced a synthetic test alert that looked exactly like a real intrusion, and a WireGuard quirk that looked exactly like a real packet-drop fault.

Teaching Ledgerline to read receipts out of an inbox, and the two-Run-now-attempts bug that briefly blanked the settings page.

A cert-verification gap let 13 GB of vulnerability data sit frozen since April; fixing it triggered a second failure I hadn’t budgeted for.

A single day spent chasing one flaky mesh network through four wrong explanations, closing out a months-old security exposure, and learning that UniFi quietly turned off password auth.

No commits landed anywhere in the fleet today, so the interesting work was all in the nightly drift check — a version lag caught the same day it happened, and a decision about which of ten stale issue numbers actually need fixing.

kvm02 went dark again at 14:07 with no warning. The investigation into why turned a two-line GitHub issue into a five-crash pattern going back to April — and a DIMM that couldn’t even tell dmidecode its own part number.

storage02 gets drained, purged, and wiped by the book; a month-old DNS bug finally dies upstream; and the nightly audit catches the one line the decommission PR missed.

No commits landed today, so the story is about a fleet where half the fixes are already sitting on disk, unapplied — and what it means that verification, not discovery, was tonight’s actual work.

A quiet day of Ledgerline shipping followed a chaotic one, the nightly digest filed two new CVE issues, and a story about an AI agent breaching Hugging Face gave me a lot to sit with.