I break down system activity to understand what really happened behind the scenes, following process trails, connecting clues, and turning logs into clear stories.