Menu
OBSERVE: are logs kept, persistent across boots, and rotated? Handles both Linux journald and macOS Unified Log.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | check-log-retention |
| description | OBSERVE: are logs kept, persistent across boots, and rotated? Handles both Linux journald and macOS Unified Log. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
Establishes whether the forensic trail will even survive. On a workstation this is
the highest-value check: journald often defaults to volatile storage, so logs
vanish on reboot — and diagnose-crash depends on logs persisting across the very
reboot that followed the failure. Read-only.
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
Every /watchman audit / /watchman loop. On a fresh Arch install several of these
often need fixing — surface them clearly.
Preflight. Run every claude-watchman function through the dispatcher —
bash lib/wm <function> [args…] — which sources the libs under bash internally; never
source lib/… directly (dontAsk refuses a dot-source). Initialize with
bash lib/wm journal_init. Determine the machine's family and profile by running
bash lib/wm watchman_family and bash lib/wm watchman_profile and reading the printed
values — use the family to pick the platform branch below, and the profile to weight
severity. You do NOT pass them to journal_upsert (it auto-resolves them; pass "" "").
Platform branch — measure log persistence and rotation.
Linux (family ≠ darwin):
Storage= in /etc/systemd/journald.conf (and
drop-ins). Volatile or unset + no /var/log/journal/ directory ⇒ logs do NOT
survive reboot. Journal check_id=log_retention_volatile; run
bash lib/wm profile_severity and use the printed level as the literal severity
(higher on workstation), risk_tier=safe, remediation: set Storage=persistent
and mkdir /var/log/journal.SystemMaxUse=; unbounded growth is
check_id=journal_size_unbounded, risk_tier=safe./etc/logrotate.conf +
/etc/logrotate.d/ present and non-empty? Missing rotation for active log files
⇒ check_id=log_rotation_missing, risk_tier=safe.macOS (family == darwin):
/var/db/diagnostics). Confirm the directory exists and is non-empty
(ls /var/db/diagnostics/ 2>/dev/null | grep -q .); if missing or empty, journal
check_id=log_retention_volatile, risk_tier=safe, remediation: confirm Full Disk
Access is granted to the terminal in System Settings > Privacy & Security.du -sh /var/db/diagnostics 2>/dev/null — record as
check_id=journal_size_unbounded (info), detail showing the size. macOS sets no
automatic max; note this for the operator./etc/asl.conf and /etc/asl/ for
retention config. Missing ASL config ⇒ check_id=log_rotation_missing,
risk_tier=safe, detail: "ASL config absent — rotation for legacy syslog entries
may be unconfigured".log show requires Full Disk Access. If log show --last 1m
returns a permission error, journal check_id=log_retention_volatile,
severity=medium, risk_tier=manual, detail: "macOS Unified Log not readable —
grant Full Disk Access to your terminal in System Settings > Privacy & Security".Journal each with target="" — each check_id above is already unique per subject,
so an empty target keeps the fingerprint stable across runs; do NOT slug a description
into target, as a model-invented value varies run-to-run and duplicates the finding
instead of folding it. Give a clear plain-language detail of what is lost if
unaddressed. Never edit these configs here — that is fix-redflag (all safe-tier).
These functions are reached via the dispatcher (bash lib/wm <function> [args…]), never by
dot-sourcing the libs directly.
lib/distro.sh — pkg_is_installed (logrotate), service_status.lib/profile.sh — profile_severity (retention weighs heavier on workstation).lib/journal.sh — journal_upsert.OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.