Ever wanted to know who triggered that Linux host in your fleet to shutdown? Perhaps you need a definitive means of determining when and how a service crashes? It may be that you need a one-stop dashboard to check a user's activity across your fleet with a high degree of precision? Or could it be that you're just tired of reading SELinux AVC messages manually? Whatever the use case, if you have a Linux fleet in your organisation, you'll want this app. For the benefit of other users, please post questions at https://answers.splunk.com unless they are of a private nature, in which case the author can be contacted using the 'Contact Developer' button on this page. PGP public key available via MIT (95B6 922E 47D2 7BC3 D1AF F62C 82BC 992E 7CDD 63B6).