Linux audit (auditd) source and LogStream internal logs

Audit source (source_type=audit), off until enabled in Settings > Sources:
- follows /var/log/audit/audit.log (path configurable, AUDIT_LOG), with
  rotation (end of audit.log.1 read first) and an offset checkpoint in
  /data/audit-state.json; last AUDIT_BACKFILL (1h) read on first enable
- groups the records of an event by msg=audit(time:serial), closed on EOE,
  after 2 s without a record, or once the log has moved 2 s past it
- fields audit_type, audit_serial, auid, user (enriched name, host
  /etc/passwd or uid), exe, res, key, audit_raw; app = audit_type, host =
  node= / AUDIT_HOST / /host/etc/hostname; summary "who: what [key] →
  result"; warning when res=failed / success=no, info otherwise
- hexadecimal values (proctitle, cmd, exec arguments…) decoded

Internal logs (source_type=logstream, host=logstream, app=component):
- logEvent() for VictoriaLogs unreachable / back, lost batches, spooled
  batches refused, syslog listener errors, Docker API and container
  streams lost, failing sources, start and stop
- on by default from warning; switch and minimum level in Settings >
  Sources (/data/selflog.json)
- bounded queue, never waits for the Store, same event at most once per
  30 s with a count of the repeats: a failing Store cannot loop

UI: violet (audit) and turquoise (LogStream) left edge and tint, AUDIT /
LS badge before the app, raw audit record under the summary (folded in
compact density until the row is opened), Audit and LogStream in the
source filter, FR/EN translations. docker-compose: optional
/var/log/audit, /etc/passwd and /etc/hostname mounts. README (EN/FR):
host prerequisites (log_group, ACL for UID 10001).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docker.go

@@ -242,7 +242,7 @@ func (m *DockerManager) setError(err error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	if m.lastErr != err.Error() {
-		log.Printf("docker: %v", err)
+		logEvent("docker", 3, "Docker API unreachable: %v", err)
 	}
 	m.connected = false
 	m.lastErr = err.Error()
@@ -290,7 +290,7 @@ func (m *DockerManager) sync(ctx context.Context) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	if !m.connected {
-		log.Printf("docker: connected, %d containers", len(list))
+		logEvent("docker", 6, "connected to the Docker API, %d containers", len(list))
 	}
 	m.connected, m.lastErr = true, ""
 	seen := map[string]bool{}
@@ -371,7 +371,7 @@ func (m *DockerManager) follow(ctx context.Context, c DockerContainer) {
 			if ctx.Err() != nil {
 				return
 			}
-			log.Printf("docker %s: %v", c.Name, err)
+			logEvent("docker", 4, "container %s: cannot inspect it: %v", c.Name, err)
 			sleepCtx(ctx, 5*time.Second)
 			continue
 		}
@@ -383,7 +383,7 @@ func (m *DockerManager) follow(ctx context.Context, c DockerContainer) {
 			return
 		}
 		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
-			log.Printf("docker %s: %v", c.Name, err)
+			logEvent("docker", 4, "container %s: log stream lost, reconnecting: %v", c.Name, err)
 		}
 		sleepCtx(ctx, time.Second)
 	}