Assessment and inventory
The assessment inspects the node, keeps its findings and answers different questions depending on the report profile.
An assessment inspects; it does not change the configuration
Run assessment starts a run with the profile selected in Report. The view shows the date of the last run and how long ago it was.
Report profiles
Each profile answers a different question. The checks and sections are selected before the document is composed.
| Profile | What it covers |
|---|---|
| Full audit | Every check and all the structure available. |
| Quick diagnosis | Every check; the result opens with the critical findings, the warnings and the readings that could not be verified. |
| Inventory | A description of the node, with no checks and no classification. |
| Security review | Exposure, access, privileges, certificates, updates, repositories and Lynis. |
| Backup assurance | Coverage, age, results, verification, retention and recovery of the backups. |
| Capacity and wear | Growth margin, memory, space usage and the service life of the disks. |
The contents of each document are described in Reports and comparisons.
How results are classified
| Classification | Meaning |
|---|---|
| Critical | A failed condition that has priority. |
| Warning | A condition that needs a review, given the evidence or the policy. |
| Observation | Information about the node that is not reported as a failure. |
| Unverified | The source the check needs could not be read. It does not mean the problem is absent. |
| Conformant | The condition meets the criterion applied. |
| Not applicable | Nothing within the scope of the check applies. |
| Accepted risk | The finding exists and a decision about it has been recorded. |
| Excluded by policy | The policy declares that the element is left out of the count. |
Findings can be filtered by area: System, Storage, Network, Security, Backup, Guests and Hardware. Each finding keeps its evidence, with the source it was read from.
When a source cannot be read
| Case | Behaviour |
|---|---|
| Unverified | The check keeps its identity, states in its evidence which source failed and does not turn missing data into a conformant result. |
| Incomplete evidence | The report names the source and the time of collection, so a real problem can be told apart from an insufficient reading. |
| A new run | Once the access, package or service is corrected, the same profile runs again and the comparison shows whether the result could be verified. |
Lynis
The security review uses the Lynis report of the host. When Lynis has not been run yet, or its report is older than the threshold of the policy, a dialog offers Run with Lynis, which takes a few minutes longer, or Run without Lynis, which uses the existing report.
Accepting a risk
Accept risk records a decision on a finding. The reason is required and is stored with the author and the date.
| Field | Options |
|---|---|
| Reason | Free text, required. |
| Stops applying after | 90 days, 180 days, 1 year or does not expire. When the period ends the finding becomes active again. |
| Remind me to review | A reminder that brings the decision back to attention while it stays in force. |
An accepted finding stays visible with its decision, and Return to active revokes it. An accepted risk is not a correction: the comparison reports it as accepted, not as resolved.
Inventory
- Identity, Proxmox VE version, kernel, subscription and cluster.
- CPU, memory, board, BIOS, controllers and IOMMU.
- Disks, SMART, power-on hours and recorded events.
- Adapters, bonds, bridges, latency and connections.
- Storage, guests with their disks and interfaces, and backups.
- PCI passthrough and the software ProxMenux manages.