Document the shared Preference row and its fallback
Held locally until PR #45 merges: this describes behaviour that does not
exist on master yet.
Co-authored-by: openhands <openhands@all-hands.dev>
Update the wiki for direct WinRM polling of Windows hosts
DAD now polls Windows hosts itself with wevtutil over WinRM instead of
requiring OpenWEC on the Windows side plus a fourth daemon to forward
what it wrote. The OpenWEC path stays documented as the alternative,
because a subscription receives events pushed to it and a pull model
cannot recover records for a host DAD cannot reach.
Windows-Events.md is restructured around the two paths sharing one
pipeline rather than around OpenWEC specifically. New material: the
priority bands and the adaptive interval (clamp(500/eps, band_min,
band_max), EMA-smoothed rate, 25% deadband), per-host disable, the
credential model and why the encryption keys must not be rotated, the
60s delta overlap and the duplicate trade, and the failure behaviour
that keeps one bad host or channel from costing the others.
Also corrected along the way, independent of this feature:
- Access-Control.md never documented ACTION_RIGHTS at all, only
CONTROLLER_RIGHTS. That is the mechanism that makes reading a target a
Viewer action while writing or polling one is Admin, so it is now
spelled out with the reason for each override.
- Interface.md had no Windows targets section, and its paginated-list
count was twelve.
- Jobs.md listed seven handlers; there are eight. Added a note that the
Job frequency is not the polling interval, since the two numbers being
different is easy to misread as a bug.
- Development.md test counts were 488/40 runs, 1679 assertions.
- Installation.md was missing DAD_AR_ENCRYPTION_KEY,
DAD_AR_ENCRYPTION_SALT and WINDOWS_SSL_VERIFY, and had no warning that
rotating the credential keys makes stored credentials unreadable --
unlike SECRET_KEY_BASE, which is safe to rotate.
- Architecture.md and Home.md described Windows collection as OpenWEC
only.
- What-Changed-Since-2016.md gets an entry, since the older pages
describe a design that no longer holds.
Stated as limits rather than glossed over: the WinRM transport is not
exercised in CI (no Windows host; the transport sits behind a seam and
the parsing/delta/queueing logic is tested against recorded wevtutil
XML), and the pull path reads rather than subscribes, so records written
while a host is unreachable are only recovered if they are still in the
channel next poll.
This wiki update was prepared by an AI agent (OpenHands) on behalf of the
repository owner.
Co-authored-by: openhands <openhands@all-hands.dev>
Update the wiki for PostgreSQL-only dev/test and the deleted provision.sh
SQLite is no longer the development and test engine, and Vagrantfile and
provision.sh are gone, so most pages described a setup that no longer exists.
- Installation: drop the Vagrant quick-start, make the manual path create a
Postgres database per environment and use db:migrate_from_scratch, and move
the secret-file guidance off provision.sh onto the systemd units.
- Development: replace "Two databases, and why CI has both" with "PostgreSQL
everywhere", documenting why db:migrate_from_scratch is required, why
maintain_test_schema is now unconditionally false (its old DATABASE_URL
condition inverted once Postgres became the default), and what
test/support/scratch_database.rb and query_plan.rb are for. Suite counts
updated to 436 runs / 1237 assertions / 0 skips.
- Search: expand the collation finding to the actual mechanism -- the
[term, term + U+10FFFF) range and why no sound upper bound exists under
en_US.UTF-8 -- with an explicit "do not reintroduce" note.
- Architecture, Retention, Jobs, Access-Control, Home: correct the
engine claims and provision.sh references.
- What Changed Since 2016: new "Removed: SQLite as the development and test
engine" section, including the two guards that look like dead SQLite
support but handle an unpartitioned Postgres install.
Co-authored-by: openhands <openhands@all-hands.dev>
Document the ingest batching and word-cache fixes
Brings the wiki in line with the code after the two ingest defects closed in
the write-path review.
Architecture: new "Batching" section - a flush chunks its multi-row INSERTs to
the adapter's bind-parameter ceiling (32,766 SQLite / 65,535 Postgres) and
commits them in one transaction, so a batch stays all-or-nothing. Explains why
events_words is the binding table (3 columns, ~16 rows per event) and that a
2000-event batch needs ~96k parameters, which is past both ceilings. New "The
word cache" section: pruned by TTL, not size, triggered past 100,000 cached
words, lifetime starting at 320s.
Development: two rules under "Before touching the ingest path". All ingest state
must be initialised in resetCaches - both defects came from variables it did not
cover. And some ingest limits are invisible to an in-process run, because
DEFAULT_BULK_INSERT_SIZE is 1 in dev/test; only RAILS_ENV=development subprocess
tests cross the parameter ceiling. Same SQLite-green/production-broken shape as
the SqlPlaceholders failure already documented on that page.
Jobs: prune_words row notes the 320s starting lifetime.
Home: status note for the ingest pass.
What Changed Since 2016: new section on both defects, including that the
extraction commit moved prune_words' reader and writer but dropped the
@@cachelifetime = 320 assignment, and that the three tests touching prune_words
each set the value by hand - which is why the suite stayed green.
Co-authored-by: openhands <openhands@all-hands.dev>
Document the 2026-11 integrity/scheduler/pagination pass, with screenshots
Brings the wiki in line with the code as of the four fixes that followed the
2026 review pass.
Jobs: the handler registry is seven operations, not six - prune_sessions is new
and seeded hourly. Failure behaviour rewritten: the loop body now lives in
JobScheduler, and a Job with no usable frequency is disarmed (next_run NULL)
rather than crashing the process. Documented why: the next_run line sat outside
the begin/rescue, so a blank Frequency field crash-looped the scheduler under
Restart=always with the row re-selected on every start, and no Job ran at all.
Access Control: session_hash unique index (the per-request cookie lookup was a
full scan), Session.purge_expired on logon plus the seeded prune_sessions job,
and username uniqueness - do_logon uses find_by, so a second account sharing a
name could never sign in, silently.
Interface: new "Paginated lists" section, 25 rows/page across all twelve
management indexes, ?page clamped at both ends, hand-rolled rather than a gem.
Two new screenshots (sessions, statistics) at the same 1440x1008 as the rest.
What Changed Since 2016: new section on the integrity constraints the
application never had, and how the migration repairs existing bad rows without
deleting any account.
Development: SQLite can create a CHECK but cannot ALTER TABLE ADD CONSTRAINT, so
the Postgres job is the only thing that exercises that branch.
Home: status note for the follow-up pass. Rails version in Interface corrected
to 8.1.4.1.
Co-authored-by: openhands <openhands@all-hands.dev>
Say where job handler output actually appears
scheduler.rb logs the handler return value
Rails.logger.info "job #{job.name} -> #{JobHandler.perform(job.script)}"
so the disk_utilization reading lands in the journal, not on the Jobs screens.
The Jobs show page lists name, operation, owner, last/next run and frequency
only. Stated on Jobs, Interface, and DAD Disk Space Warnings, since all three
now tell the reader to check the job output.
Co-authored-by: openhands <openhands@all-hands.dev>
Add interface screenshots and correct disk/search documentation
Adds an Interface page with screenshots of the running UI (login, dashboard,
search results, jobs, users/roles/rights, preferences, alerts, displays,
exclusions, stored searches, systems) taken against a seeded demonstration
dataset, and threads the relevant ones into the pages they describe.
Corrects the record on disk utilization: there is no dashboard disk gauge. The
author commented it out in bec738c ("Hiding disk gauge", 2015-02-28); the live
surfaces are the disk_utilization job and preferences.archiveFreeSpacePercent.
Documents the open search-form bug (RECOMMENDATIONS 2.3): the Rails check_box
always submits timesearch_enabled[enabled]=0, and EventsController#search
branches on the presence of that key, so every form search takes the absolute
date branch with a now->now window and reports 0 events.
Co-authored-by: openhands <openhands@all-hands.dev>
Bring the wiki in line with the current project
The wiki last changed in April 2016 and described an alpha that let you type
Ruby into the Jobs form and the display editor. Both of those designs are gone,
so the pages were not just stale but actively misleading.
New pages: Architecture, Installation, Search, Displays (rewritten), Jobs,
Retention and Archives, Access Control, Exclusions, Development, and What
Changed Since 2016, which maps the 2015 material onto the current code.
The eight alerting recipes are kept as a recipe archive with a banner and an
API-status table on Example Jobs: the analysis shape still ports, but they call
a Job design that no longer exists, and Math.mean/variance/standard_deviation
were removed in favour of Stats.
Home is now a landing page with a status summary and a task-based index.
Co-authored-by: openhands <openhands@all-hands.dev>