The audit log for a computer's on/off switch comes with the computer

Something in the customer-data project restarted nine times last night. Nobody is sure what, or whether a person did it.

GET /api/v1/containers/{id}/status-logs?sort_by=transition_time&sort_order=desc lists every state change: from_status, to_status, transition_time, how long the previous state lasted in duration_ms, and triggered_by, user or system, with metadata.command when a recognized command caused it. Nine running → stopped → running pairs, all system, each running about four minutes long: a crash loop, not an operator. A nightly cron walks the project's containers, counts transitions per day, and posts anything above three to the ops channel with the triggering party attached.

Restart frequency is the oldest stability signal there is. Here it is already recorded, per container, with attribution, before you set anything up.

The audit log for a computer's on/off switch comes with the computer.