# Known False Flags

Items below are proven harmless. Health-check cron filters these before reporting.

## Current False Flags

| Flag | Server | Proof | Date Proven |
|------|--------|-------|-------------|
| GPU1 at 95%+ | kaburuaibox | Qwopus-27B normally uses 11.7-11.9GB of 12GB VRAM. Steady-state, no leak. | 2026-07-02 |
| OPNsense unreachable (ping) | OPNsense (192.168.0.1) | OPNsense drops all ICMP by design. Verify via API (`opnsense:diagnostics_manage`) instead. | Permanent |
| root-owned files in /home/*/public_html | Hetzner | `find` hits parent `..` entry for directories under /home/ — that's /home/ owned by root:root, normal for all sites. Current count: 0. | 2026-07-03 |
| search.kaburu.cc root-owned | Hetzner | Abandoned CyberPanel placeholder. Has user `searc6943`, empty public_html, no root-owned content. Verified 0 files owned by root. | 2026-07-03 |
| SPF missing on subdomains | Hetzner | billing.myretonmarquees, chippy.kaburu, invoice.kaburu, stats.kaburu — subdomains/build sites with no MX, inherit parent domain email. No SPF needed. Full DNS/SPF re-audit 2026-07-14 still clean for all real mail domains except doctorfin/pilates MX (_dc-mx leftover) — see [[dns-spf-audit]]. | 2026-07-03 |
| ubuntu-svr rkhunter log stale | ubuntu-svr | Fixed 2026-07-03: `--cron` flag invalid on rkhunter 1.4.6; cron was in `kaburu` user crontab (no write access to root-owned log). Migrated to root crontab with `--check --skip-keypress`. Verified. | 2026-07-03 |
| TrueNAS Lynis at non-standard path | TrueNAS | Lynis output at /var/tmp/lynis-*.log not /var/log/lynis-report.dat. TrueNAS noexec + custom cron path. Health check updated to check /var/tmp/lynis-full.log. | 2026-07-03 |
| WP-Cron triggers in root crontab | Hetzner | Health check was grepping per-user crontabs but triggers live in root's crontab (23 sites via wget). Updated to check root crontab. | 2026-07-03 |
| Open WebUI :3000 down | kaburuaibox | Intentionally stopped/disabled 2026-07-14. Emergency-only; left running it burns tokens for nothing. Hermes is the primary chat UI. | 2026-07-14 |
|| Tailscale kaburu-m67 offline | laptop | Divi-bot workstation. Powered on only when building sites; otherwise off. Expected offline. | 2026-07-15 |
|| Tailscale kaburu-um790-main offline | workstation | Steve's main workstation. Sleeps when not in use. Expected offline. | 2026-07-25 |

## Verification Commands

To re-verify a false flag before re-adding to this list:

- **GPU**: `nvidia-smi --query-gpu=memory.used --format=csv,noheader`
- **OPNsense**: use MCP API, never ping
- **Root-owned files**: `find /home/*/public_html -user root -group root 2>/dev/null | wc -l`
- **search.kaburu.cc**: `find /home/search.kaburu.cc -user root -group root 2>/dev/null | wc -l`