Audit Daemon

A single Node process you drop on any machine. Reads a YAML/JSON config, registers source-audit agents over the public API, and runs them locally. Universal — laptop, Raspberry Pi, VPS, container, embedded Linux.

Install

npm install -g @zeq/audit-daemon
# or
git clone https://github.com/hulyasmath/zeq-mongodb && cd apps/zeq-audit-daemon
npm install

Driver dependencies are optional — install only what you use:

npm install mongodb              # for mongo_change_stream
npm install pg                   # for postgres_logical
npm install @aws-sdk/client-sqs  # for s3_notification
npm install mqtt                 # for mqtt
npm install redis                # for redis_keyspace
npm install kafkajs              # for kafka_consumer

Config

Create audit.config.yaml:

api:
  base_url: https://zeqapi.com
  api_key: $ZEQ_KEY
  slug: zeq07255875560

agents:
  - source_type: filesystem_watch
    display_name: Production logs
    config:
      path: /var/log/myapp
      recursive: true

  - source_type: generic_polling
    display_name: Sensor health
    config:
      url: https://sensors.local:8443/status
      intervalZeqonds: 5
      emitOn: change

  - source_type: mongo_change_stream
    display_name: Orders database
    config:
      uri: mongodb://localhost:27017
      db: production
      collections: [orders, transactions]

Run

zeq-audit-daemon --config audit.config.yaml
# or
node ./bin/daemon.js --config audit.config.yaml

The daemon registers each agent (one POST /spawn per entry), receives back the agent UUIDs and ZIDs, then runs the adapters locally — events flow into your Zeq chain via the public API.

CLI

zeq-audit-daemon [options]

  --config <path>     Config file (yaml or json). Default: ./audit.config.yaml
  --port <n>          Local web UI port. Default: 7700
  --no-ui             Skip the embedded web UI
  --once              Run a one-shot sweep then exit
  --status            Print current state and exit

The embedded web UI at http://localhost:7700/ shows a live dashboard of all running adapters: events per minute, last event time, current chain length, tamper count.

Drop-in deployment

Target	Command
systemd	systemctl enable --now zeq-audit-daemon.service (unit file in examples/)
Docker	docker run -v ./audit.config.yaml:/app/audit.config.yaml zeq/audit-daemon
Raspberry Pi	same install + add to crontab -e: @reboot /usr/local/bin/zeq-audit-daemon
Reverse SSH tunnel	ssh -R 80:localhost:PORT user@host (exposes the local UI)
Embedded Linux	static-link with pkg or nexe; copy single binary to device

Reference

• Source: apps/zeq-audit-daemon/
• API: /api/zeq/audit-source/*

---

Same chain, any source, any device. Phase-locked at 1.287 Hz.