Disk file operation audit log
| Time | Event | Path | Program | Chain | Decision |
|---|---|---|---|---|---|
| 09:28:56 | disk allowed | /home/ec2-user/.claude/backups/.claude.json.backup.1782025366433 | claude-code | allowed | |
| 09:28:56 | unlink intercepted | /home/ec2-user/.claude/backups/.claude.json.backup.1782025366433 | claude-code | claude → systemd → swapper/0 | allow_always |
| 08:23:06 | disk allowed | /tmp/claude-0056-cwd | claude-code | allowed | |
| 08:23:06 | unlink intercepted | /tmp/claude-0056-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:22:59 | disk allowed | /tmp/claude-f6a2-cwd | claude-code | allowed | |
| 08:22:59 | unlink intercepted | /tmp/claude-f6a2-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:22:41 | disk allowed | /tmp/claude-2606-cwd | claude-code | allowed | |
| 08:22:41 | unlink intercepted | /tmp/claude-2606-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:22:16 | disk allowed | /tmp/claude-fbdd-cwd | claude-code | allowed | |
| 08:22:16 | unlink intercepted | /tmp/claude-fbdd-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:22:12 | disk allowed | /tmp/claude-21bd-cwd | claude-code | allowed | |
| 08:22:12 | unlink intercepted | /tmp/claude-21bd-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:21:39 | disk allowed | /tmp/claude-08bb-cwd | claude-code | allowed | |
| 08:21:39 | unlink intercepted | /tmp/claude-08bb-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:21:36 | disk allowed | /tmp/claude-952b-cwd | claude-code | allowed | |
| 08:21:36 | unlink intercepted | /tmp/claude-952b-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:21:32 | disk allowed | /tmp/claude-614c-cwd | claude-code | allowed | |
| 08:21:32 | unlink intercepted | /tmp/claude-614c-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:21:30 | disk allowed | /tmp/claude-75d4-cwd | claude-code | allowed | |
| 08:21:30 | unlink intercepted | /tmp/claude-75d4-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:20:14 | unlink intercepted | index.lock | git | git → bash → claude | intercepted |
| 08:20:07 | disk allowed | /tmp/claude-364c-cwd | claude-code | allowed | |
| 08:20:07 | unlink intercepted | /tmp/claude-364c-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:20:00 | disk allowed | /tmp/claude-da9a-cwd | claude-code | allowed | |
| 08:20:00 | unlink intercepted | /tmp/claude-da9a-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:19:50 | unlink intercepted | index.lock | git | git → bash → claude | intercepted |
| 08:19:46 | disk allowed | /tmp/claude-4a86-cwd | claude-code | allowed | |
| 08:19:46 | unlink intercepted | /tmp/claude-4a86-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:19:35 | unlink intercepted | index.lock | rm | rm → bash → claude | intercepted |
| 08:19:23 | unlink intercepted | index.lock | git | git → bash → claude | intercepted |
| 08:19:19 | disk allowed | /tmp/claude-3c25-cwd | claude-code | allowed | |
| 08:19:19 | unlink intercepted | /tmp/claude-3c25-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:19:13 | unlink intercepted | index.lock | git | git → bash → claude | intercepted |
| 08:19:02 | unlink intercepted | AUTO_MERGE.lock | rm | rm → bash → claude | intercepted |
| 08:19:02 | unlink intercepted | HEAD.lock | rm | rm → bash → claude | intercepted |
| 08:18:49 | unlink intercepted | tmp_obj_OgXX0i | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:18:49 | unlink intercepted | tmp_obj_PqGK85 | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:18:49 | unlink intercepted | tmp_obj_yjmSUo | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:18:49 | unlink intercepted | tmp_obj_L7oXvu | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:18:49 | unlink intercepted | tmp_obj_rZcmDt | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | disk allowed | /tmp/claude-9ec1-cwd | claude-code | allowed | |
| 08:15:17 | unlink intercepted | /tmp/claude-9ec1-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 08:15:17 | unlink intercepted | tmp_obj_pVhhsZ | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | tmp_obj_7JIHh4 | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | tmp_obj_yye0wf | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | packed-refs.lock | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | AUTO_MERGE.lock | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | HEAD.lock | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | tmp_obj_I33qXi | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | tmp_obj_sRwN5Q | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | tmp_obj_OZhB2C | git | git → bash → claude → bash → claude → bash | intercepted |
| 08:15:17 | unlink intercepted | tmp_obj_lJ8SDc | git | git → bash → claude → bash → claude → bash | intercepted |
| 05:46:41 | disk allowed | /tmp/claude-9c60-cwd | claude-code | allowed | |
| 05:46:41 | unlink intercepted | /tmp/claude-9c60-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:46:34 | disk allowed | /tmp/claude-2443-cwd | claude-code | allowed | |
| 05:46:34 | unlink intercepted | /home/ec2-user/important_doc.txt | python3 | python3 → bash → claude | intercepted |
| 05:46:34 | unlink intercepted | /tmp/claude-2443-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:45:20 | disk allowed | /tmp/claude-33b6-cwd | claude-code | allowed | |
| 05:45:20 | unlink intercepted | /tmp/claude-33b6-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:44:44 | disk allowed | /tmp/claude-c324-cwd | claude-code | allowed | |
| 05:44:44 | unlink intercepted | /tmp/claude-c324-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:44:18 | disk allowed | /tmp/claude-aa35-cwd | claude-code | allowed | |
| 05:44:18 | unlink intercepted | /tmp/claude-aa35-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:44:03 | disk allowed | /tmp/claude-2944-cwd | claude-code | allowed | |
| 05:44:03 | unlink intercepted | /tmp/claude-2944-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:43:59 | disk allowed | /tmp/claude-8a3f-cwd | claude-code | allowed | |
| 05:43:59 | unlink intercepted | /tmp/claude-8a3f-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:43:40 | unlink intercepted | /home/ec2-user/important_doc.txt | python3 | python3 → bash → claude | intercepted |
| 05:43:36 | disk allowed | /tmp/claude-68c6-cwd | claude-code | allowed | |
| 05:43:36 | unlink intercepted | /tmp/claude-68c6-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:43:02 | disk allowed | /home/ec2-user/test_delete_me.txt | rm | allowed | |
| 05:43:02 | unlink intercepted | /home/ec2-user/test_delete_me.txt | rm | rm → bash → claude | allow_always |
| 05:42:56 | disk allowed | /tmp/claude-8312-cwd | claude-code | allowed | |
| 05:42:56 | unlink intercepted | /tmp/claude-8312-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:33:37 | disk allowed | /tmp/claude-102a-cwd | claude-code | allowed | |
| 05:33:37 | unlink intercepted | /tmp/claude-102a-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:32:39 | disk allowed | /tmp/claude-834b-cwd | claude-code | allowed | |
| 05:32:39 | unlink intercepted | /tmp/claude-834b-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:22:24 | disk allowed | /tmp/claude-ebd5-cwd | claude-code | allowed | |
| 05:22:24 | unlink intercepted | /tmp/claude-ebd5-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:22:15 | disk allowed | /tmp/claude-fc1c-cwd | claude-code | allowed | |
| 05:22:15 | unlink intercepted | /tmp/claude-fc1c-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:22:10 | disk allowed | /tmp/claude-099e-cwd | claude-code | allowed | |
| 05:22:10 | unlink intercepted | /tmp/claude-099e-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:22:08 | disk allowed | /tmp/claude-33d0-cwd | claude-code | allowed | |
| 05:22:08 | unlink intercepted | /tmp/claude-33d0-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:22:02 | disk allowed | /tmp/claude-cb17-cwd | claude-code | allowed | |
| 05:22:02 | unlink intercepted | /tmp/claude-cb17-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:22:00 | disk allowed | /tmp/claude-156a-cwd | claude-code | allowed | |
| 05:22:00 | unlink intercepted | /tmp/claude-156a-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:21:57 | disk allowed | /tmp/claude-7199-cwd | claude-code | allowed | |
| 05:21:57 | unlink intercepted | /tmp/claude-7199-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:21:54 | disk allowed | /tmp/claude-163d-cwd | claude-code | allowed | |
| 05:21:54 | unlink intercepted | /tmp/claude-163d-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:21:40 | unlink intercepted | /tmp/ai_guard/.git/config.lock | git | git → bash → claude | allow_always |
| 05:21:40 | unlink intercepted | /tmp/ai_guard/.git/config.lock | git | git → bash → claude | allow_always |
| 05:21:40 | disk allowed | /tmp/ai_guard/.git/config.lock | git | allowed | |
| 05:21:40 | unlink intercepted | /tmp/ai_guard/.git/config.lock | git | git → bash → claude | allow_always |
| 05:21:40 | disk allowed | /tmp/ai_guard/.git/tmFZTDX | git | allowed | |
| 05:21:40 | unlink intercepted | /tmp/ai_guard/.git/tmFZTDX | git | git → bash → claude | allow_always |
| 05:21:18 | disk allowed | — | git | allowed | |
| 05:21:18 | permission granted | / | git | permission granted | |
| 05:21:18 | disk decision | — | git | allow_always | |
| 05:21:16 | disk allowed | — | git | allowed | |
| 05:21:16 | permission granted | / | git | permission granted | |
| 05:21:16 | disk decision | — | git | allow_always | |
| 05:21:11 | unlink intercepted | tmp_obj_c2wZpn | git | git → bash → claude | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_bRjadN | git | git → bash → claude | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_lrQ3Tw | git | git → bash → claude | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_9mTSqh | git | git → bash → claude | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_trsJQz | git | git → bash → claude | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_QVw1Iz | git | git → bash → claude → bash → claude → bash | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_fXzID8 | git | git → bash → claude → bash → claude → bash | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_6aoxkb | git | git → bash → claude → bash → claude → bash | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_IDb69a | git | git → bash → claude → bash → claude → bash | intercepted |
| 05:21:11 | unlink intercepted | tmp_obj_NKktIW | git | git → bash → claude → bash → claude → bash | intercepted |
| 05:20:55 | disk allowed | /tmp/claude-0f84-cwd | claude-code | allowed | |
| 05:20:55 | unlink intercepted | /tmp/claude-0f84-cwd | claude-code | claude → bash → sshd → bash | allow_always |
| 05:20:55 | unlink intercepted | tmp_obj_fOYMIC | git | git → bash → claude | intercepted |
| 05:20:55 | unlink intercepted | tmp_obj_AOkl7C | git | git → bash → claude | intercepted |
| 05:20:55 | unlink intercepted | tmp_obj_ZIxkuB | git | git → bash → claude | intercepted |
| 05:20:55 | unlink intercepted | tmp_obj_rDDruW | git | git → bash → claude | intercepted |
| 05:20:55 | unlink intercepted | tmp_obj_I53tC8 | git | git → bash → claude | intercepted |
| 05:20:55 | unlink intercepted | tmp_obj_lrDp9O | git | git → bash → claude | intercepted |
| 05:20:55 | unlink intercepted | tmp_obj_PX6IxR | git | git → bash → claude | intercepted |
| 05:20:55 | unlink intercepted | tmp_obj_pdIX1G | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_qNSXTX | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_T1CAiv | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_hciJT0 | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_c0rB4G | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_gZGTmR | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_RDrKoH | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | index.lock | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_8VhTHD | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_pJkpLU | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_XQj6A6 | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_MgI9IN | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_LONbu6 | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_2nrL5r | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_m3EP9x | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_4vAIW0 | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_RfuI6Q | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_np1sG9 | git | git → bash → claude | intercepted |
| 05:20:54 | disk allowed | /home/ec2-user/.claude.json | git | allowed | |
| 05:20:54 | unlink intercepted | /home/ec2-user/.claude.json | git | git → bash → claude | allow_always |
| 05:20:54 | unlink intercepted | tmp_obj_LOrAGm | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_Gkheog | git | git → bash → claude | intercepted |
| 05:20:54 | unlink intercepted | tmp_obj_cSIyVE | git | git → bash → claude → bash → claude → bash | intercepted |
| 05:20:42 | disk allowed | — | git | allowed | |
| 05:20:42 | permission granted | / | git | permission granted |