Audit Daemon — universal source-audit
The Audit Daemon turns anything that emits events into an entry on a machine's tamper-evident audit chain. A server, a device, a website, a piece of hardware — point it at the daemon and its events become clock-stamped, provable rows on the chain you control.
Every source is an agent
Each source you connect becomes one agent with its own ZeqID, and every event it pipes in is stamped with KO42 on the 1.287 Hz pulse. So you don't just collect logs — you get an attributable, clock-anchored record: this source, identified by this ZeqID, reported this at this Zeqond. You choose which of your machines receives the events; your machines load from your account.
Nine ways in, one pipeline
The daemon speaks nine source types, and they all converge on the same downstream pipeline:
| HTTP webhook | Filesystem | Polling |
| MongoDB | Postgres | S3 |
| MQTT | Redis | Kafka |
Whatever the source — a webhook from a SaaS tool, a table in Postgres, a topic on Kafka, files on disk — the events land the same way: as agent-attributed, KO42-stamped rows on your chain, viewable in the observer and verifiable like everything else.
Why it matters
Ordinary audit logging trusts the logger. Here the record is hash-linked and clock-sealed, and each source carries its own identity — so a compliance trail assembled from a dozen systems becomes one coherent, provable chain instead of a dozen logs you have to reconcile and believe. It's the framework's audit guarantee, extended to the rest of your stack.
Open it
Read next
- Observing a machine — where the piped events show up.
- ZeqID — the identity each source agent carries.
- Proofs — why the assembled record is trustworthy.