By name: openvpn-peak-session-spike-audit description: >- Use when dashboard/history peak active sessions jumps unexpectedly and needs trusted-vs-suspect classification with evidence. Trigger on: "peak active", "session spike", "anomaly", "history sqlite", "UNDEF user".
OpenVPN Peak Session Spike Audit
Workflow:
- Query history snapshots for target day/time.
- Extract peak-row session identities, endpoints, protocol, bytes, and source status file.
- Classify trusted vs suspect sessions.
- Compute raw/trusted/suspect distributions.
- Correlate with OpenVPN service journals.
Rules:
- Read-only evidence gathering.
- Explicitly label confidence and data quality caveats.
Output:
- Evidence table
- Trusted vs suspect summary
- Root-cause conclusion
- Low-risk follow-up actions