Linux already records every command. It records them in fragments nobody reads. corvo turns those fragments into one readable line per command, and ninho keeps the trail of your whole fleet in one place, ready for the day someone asks who did it.
Nothing leaves the queue before the acknowledgement.
open source, MIT · RPM and DEB · no agent fleet to babysitEvery event waits on the machine's own disk until the server confirms it arrived. Restart the collector, take the server down for maintenance, lose the link for a day: the trail picks up where it stopped, with no hole in the middle.
Who ran what, where, and whether it worked, for the whole fleet on one screen. Numeric identifiers come back as the names of real people, so an incident review reads like a sentence instead of a decoding exercise.
Killing the collector is the cheapest way for an intruder to disappear. ninho shows how long each machine has been quiet, so a trail that stopped arriving stops looking like a quiet night.
This is what a single id -u looks like on the way in and on the way out. Everything else on this site is a variation of this one move.
type=SYSCALL msg=audit(1756938610.123:2841): arch=c000003e syscall=59 success=yes exit=0 auid=0 uid=0 pid=48213 type=EXECVE msg=audit(1756938610.123:2841): argc=2 a0="id" a1="-u" type=CWD msg=audit(1756938610.123:2841): cwd="/root" type=PATH msg=audit(1756938610.123:2841): name="/usr/bin/id" inode=1049 nametype=NORMAL type=PROCTITLE msg=audit(1756938610.123:2841): proctitle=6964202D75
{
"v": 1,
"id": "srv-web-01-2841-1756938610123000000",
"host": "srv-web-01",
"event": {
"sequence": 2841, "record_type": "syscall", "result": "success",
"summary": { "actor": { "primary": "root" }, "action": "executed",
"object": { "primary": "/usr/bin/id" } },
"user": { "names": { "auid": "root", "uid": "root" } },
"process": { "pid": "48213", "exe": "/usr/bin/id", "args": ["id", "-u"] }
}
}id to deduplicate on.
A silent machine can be an idle machine or a dead collector, and nothing can tell you which. The queue keeps a second copy on disk, so the written volume roughly doubles. TLS belongs to the reverse proxy in front. All of that is on the how it works page, not buried in a footnote after you have deployed.
Tutorials, how-to guides, reference and the reasoning behind each decision, for the side that runs on the audited machine.
corvo docs → ninho · the serverDeploying, signing in with your directory, querying the trail from a script, and every route and column, for the side that keeps it.
ninho docs →