Module entity_timeline

vault_audit_tools::commands

Module entity_timeline 

Source
Expand description

Entity timeline visualization command.

⚠️ DEPRECATED: Use entity-analysis timeline instead.

# Old (deprecated):
vault-audit entity-timeline logs/*.log --entity-id abc-123-def

# New (recommended):
vault-audit entity-analysis timeline --entity-id abc-123-def logs/*.log

See entity_analysis for the unified command.

Generates a detailed timeline of all operations performed by a specific entity, useful for understanding entity behavior and troubleshooting issues. Supports multi-file analysis to track entities across multiple days.

§Usage

# Single file
vault-audit entity-timeline audit.log --entity-id abc-123-def

# Multi-day timeline
vault-audit entity-timeline day1.log day2.log day3.log --entity-id abc-123-def

§Output

Displays a chronological view of the entity’s activity:

  • Timestamp
  • Operation type (read, write, list, etc.)
  • Path accessed
  • Response status

Also provides:

  • Activity summary (operations by type)
  • Time-based patterns (hourly distribution)
  • Mount point usage
  • First and last seen timestamps

Functions§

run