The incident report is a diff between two machines

The overnight agent did something to the analytics container, and reading logs is the slow way to find out what.

The fast way: diff the machines. Copy the container from last night's pre-run snapshot into a scratch container: that's the before. The current container is the after. Both machines expose their filesystems over HTTP, so the agent compares them file by file: hashes first, contents where the hashes differ.

Then it writes the summary itself: 14 files changed, one crontab line added, one package upgraded. Every change the run made is on the list, because everything it touched was on disk, and both disks still exist.

Logs tell you what a process claimed to do. The incident report is a diff between two machines.

The incident report is a diff between two machines.