Logs — what's recorded and where it's saved

SubnetSlinger keeps three separate records, all on THIS machine (nothing is sent anywhere): the Activity log, Incidents and the MCP server audit.

Activity log (the audit trail): every action: time · user · context · tool · action · result. The Activity tool shows the newest 500 in-app; the history on disk is a tab-separated file, activity.log, in the app's data folder (%APPDATA%\SubnetSlinger as the app sees it; under the Store install Windows keeps it in %LOCALAPPDATA%\Packages\AISMITHPDX.SubnetSlinger_…\LocalCache\Roaming\SubnetSlinger). Set a Project (or a Context) and it stamps every line, so the log maps to a ticket. Export to CSV from the Activity tool.

Incidents (the work log): the narrative you build by hand or that Runbooks / Drift / the Posse write for you: timestamped notes, severity, resolve state, Markdown export. This is the story for a handoff or ticket (saved as incidents.json in the same folder).

MCP server audit: when an external tool (Claude Desktop, Cursor) drives SubnetSlinger's MCP server, every tool call is logged to a file so stdout stays clean for the protocol (saved as mcp.log in the same folder).

Find them fast: the Files tool lists and previews the files in the app's data folder and Documents\SubnetSlinger. Retention: the in-app Activity view caps at 500 rows. activity.log on disk rotates at about 5 MB: the current file becomes activity.log.1 and the one before that is removed, so it never grows without limit — export to CSV if you need to keep older history. The Deputy and Posse also log each tool call to the Activity trail.

Damaged files are set aside, never wiped: a saved file that can't be read is renamed to <name>.corrupt-<date-time>.json in the same folder and that list starts empty — your data is still in the .corrupt- file for you or support to recover. An Activity line and a one-time notice say so. It covers incidents, runbooks, inventory, Monitor targets, projects, the SPOG board, Golden config and the rest. Saves are written to a temporary file first and swapped in, so a crash mid-save leaves the old file or the new one, never half of one.

One copy at a time: opening SubnetSlinger while it's already running brings the open window to the front instead of starting a second copy (two copies would overwrite each other's saved work).