- Login/Logout: record user authentication events with source IP
- Login failed: record failed login attempts for security audit
- Export: record data export operations
- Machine status change: record online/offline transitions with reason
- SSH sync: record automatic SSH sync success/failure with error details
- All auto-generated logs use username='system' and empty source_ip