Policy
The policy declares what no inspection can deduce: what each guest and storage is for and the thresholds the checks apply.
With no declaration, the report describes; with one, it assesses
Guests
Each VM and LXC of the node has three fields. A value left as default takes the general value, shown next to it.
| Field | Values | Effect on the assessment |
|---|---|---|
| Backup | Required, Not required, Not stated | A missing backup is a warning when it is required, an observation when it is not stated, and it is left out of the count when it is not required. |
| Autostart | Required, Not required, Not stated | Whether the guest has to start with the host. |
| Recovery objective | Hours | The maximum acceptable age of the last backup. |
Storage
Each storage of the node is declared Essential, Optional or Not stated.
An unreachable storage is reported as critical when it is declared essential or serves a running guest, as a warning when its role is not stated, and as an observation when it is declared optional.
Thresholds
An empty threshold uses the shipped value, shown as its placeholder.
- Storage capacity review (%) and thin pool fill review (%).
- Thin overprovisioning ratio and memory overcommit ratio.
- ZFS scrub interval (days).
- Backup age fallback (days) and schedule grace (ratio).
- Certificate expiry notice (days).
- Disk service life (hours) and recent disk error window (days).
- Lynis report age (days) and package index age (days).
- Journal against its cap (%).
- Filesystem space review (%) and filesystem inode review (%).
How the policy is saved
The declaration is validated and saved atomically in /usr/local/share/proxmenux/audit_policy.json. Each save carries a revision: if the declaration changed in another session, the draft is not saved and the view offers to reload the saved declaration.
The policy is never inferred