=== 1.5 ATTRIBUTION (clean) — source IP + token + endpoint + user agent ===
window: 18/08 09:51Z -> 20/08 08:0xZ, from access.log.1 + access.log
  40598 10.77.0.3 felhom@pbs!demo-hp /api2/json/admin/datastore" 200 libwww-perl/6.78
  40594 10.77.0.2 felhom@pbs!demo-felhom /api2/json/admin/datastore" 200 libwww-perl/6.78
  40032 10.77.0.3 felhom@pbs!demo-hp /api2/json/admin/datastore/felhom-offsite/status" 200 proxmox-backup-client/1.0
  40029 10.77.0.2 felhom@pbs!demo-felhom /api2/json/admin/datastore/felhom-offsite/status" 200 proxmox-backup-client/1.0
    566 10.77.0.3 felhom@pbs!demo-hp /api2/json/admin/datastore/felhom-offsite/snapshots libwww-perl/6.78
    565 10.77.0.2 felhom@pbs!demo-felhom /api2/json/admin/datastore/felhom-offsite/snapshots libwww-perl/6.78
    194 10.77.0.2 felhom@pbs!demo-felhom /api2/json/admin/datastore/felhom-offsite/snapshots Go-http-client/1.1
    193 10.77.0.3 felhom@pbs!demo-hp /api2/json/admin/datastore/felhom-offsite/snapshots Go-http-client/1.1
    186 10.77.0.2 felhom@pbs!demo-felhom /api2/json/version" 200 Go-http-client/1.1
    185 10.77.0.3 felhom@pbs!demo-hp /api2/json/version" 200 Go-http-client/1.1
      8 10.77.0.3 felhom@pbs!demo-hp /api2/json/admin/datastore/felhom-offsite/verify" 200 Go-http-client/1.1
      8 10.77.0.2 felhom@pbs!demo-felhom /api2/json/admin/datastore/felhom-offsite/verify" 200 Go-http-client/1.1
      5 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000003:6A84A9FD:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1
      5 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000001:6A84559D:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1
      4 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000006:6A84FE5D:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1
      4 10.77.0.3 felhom@pbs!demo-hp //api2/json/reader proxmox-backup-client/1.0
      4 10.77.0.2 felhom@pbs!demo-felhom /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:0000000C:6A8534EF:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dfelhom:felhom@pbs%21demo-felhom:/status" 200 Go-http-client/1.1
      4 10.77.0.2 felhom@pbs!demo-felhom /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000004:6A84E08F:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dfelhom:felhom@pbs%21demo-felhom:/status" 200 Go-http-client/1.1
      4 10.77.0.2 felhom@pbs!demo-felhom /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000000:6A8437CF:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dfelhom:felhom@pbs%21demo-felhom:/status" 200 Go-http-client/1.1
      4 10.77.0.2 felhom@pbs!demo-felhom //api2/json/reader proxmox-backup-client/1.0
      3 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000011:6A8552BD:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1
      2 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:0000001D:6A86A43D:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1
      2 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000019:6A864FDD:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1
      2 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000016:6A85FB7D:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1
      2 10.77.0.3 felhom@pbs!demo-hp /api2/json/nodes/felhom-hetzner/tasks/UPID:felhom-hetzner:00086AE7:07B20B30:00000014:6A85A71D:verify:felhom%5Cx2doffsite%5Cx3ans-demo%5Cx2dhp:felhom@pbs%21demo-hp:/status" 200 Go-http-client/1.1

=== per-box request totals in that same window ===
  81603 10.77.0.2
  81612 10.77.0.3

=== which token belongs to which IP ===
10.77.0.2 felhom@pbs!demo-felhom
10.77.0.3 felhom@pbs!demo-hp

=== 1.6 verify-job timestamps (are they inside the window?) ===
      1 17/08/2026:12:52:45 +0000
      1 17/08/2026:16:45:35 +0000
      1 18/08/2026:04:45:35 +0000
      1 18/08/2026:06:52:45 +0000
      1 18/08/2026:10:45:35 +0000
      1 18/08/2026:12:52:45 +0000
      1 18/08/2026:16:45:35 +0000
      1 18/08/2026:18:52:45 +0000
      1 18/08/2026:22:45:35 +0000
      1 19/08/2026:00:52:45 +0000
      1 19/08/2026:04:45:35 +0000
      1 19/08/2026:06:52:45 +0000
      1 19/08/2026:10:45:35 +0000
      1 19/08/2026:12:52:45 +0000
      1 19/08/2026:16:45:35 +0000
      1 19/08/2026:18:52:45 +0000
      1 19/08/2026:22:45:35 +0000
      1 20/08/2026:00:52:45 +0000
      1 20/08/2026:04:45:35 +0000
      1 20/08/2026:06:52:45 +0000

=== 1.6 reader / backup protocol upgrades with timestamps ===
      1 18/08/2026 03:57
      1 18/08/2026 03:58
      3 19/08/2026 04:45
      1 19/08/2026 04:50
      3 19/08/2026 06:52
      1 19/08/2026 06:54

=== 1.6 any HTTP error (non-2xx) in the window ===
      8 101
 163207 200
