From c8b85316e9542797c1a0353e157a01b119de7a15 Mon Sep 17 00:00:00 2001
From: Ivo Oskamp <ivooskamp@oskamp.info>
Date: Mon, 12 Jan 2026 09:21:16 +0100
Subject: [PATCH] Auto-commit local changes before build (2026-01-12 09:21:16)

---
 .last-branch                                               | 2 +-
 .../backupchecks/src/backend/app/parsers/ntfs_auditing.py  | 4 ++--
 docs/changelog.md                                          | 7 +++++++
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.last-branch b/.last-branch
index 7322685..5b7bf8a 100644
--- a/.last-branch
+++ b/.last-branch
@@ -1 +1 @@
-v20260109-11-ntfs-auditing-audit-parser
+v20260109-12-ntfs-audit-fqdn-jobname
diff --git a/containers/backupchecks/src/backend/app/parsers/ntfs_auditing.py b/containers/backupchecks/src/backend/app/parsers/ntfs_auditing.py
index 83213e0..67015f7 100644
--- a/containers/backupchecks/src/backend/app/parsers/ntfs_auditing.py
+++ b/containers/backupchecks/src/backend/app/parsers/ntfs_auditing.py
@@ -39,8 +39,8 @@ def try_parse_ntfs_auditing(msg: MailMessage) -> Tuple[bool, Dict, List[Dict]]:
 
     subject = _normalize_subject(subject_raw)
 
-    # Find the host part between "Bouter" and "file audits".
-    m = re.search(r"\bBouter\b\s+(?P<host>[^\s]+)\s+file\s+audits\b", subject, flags=re.IGNORECASE)
+    # Find the hostname/FQDN at the start of the subject (before "file audits").
+    m = re.search(r"^(?P<host>[^\s]+)\s+file\s+audits\b", subject, flags=re.IGNORECASE)
     if not m:
         return False, {}, []
 
diff --git a/docs/changelog.md b/docs/changelog.md
index 515b66c..38b89ad 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -90,6 +90,13 @@
 - Handled reports without an overall status by defaulting the result to Success.
 - Ensured existing missing-run logic is applied when no audit report mail is received.
 - Defined that these audit mails contain no objects; object list remains empty.
+
+---
+
+## v20260109-12-ntfs-audit-fqdn-jobname
+
+- Updated NTFS Auditing (Audit) subject parsing to extract the hostname/FQDN directly from the start of the subject before "file audits".
+- Removed the dependency on a fixed "Bouter <host>" subject prefix, so hosts like dc01.totall-it.local and fs01.totall-it.local are recognized.
 ================================================================================================================================================
 ## v0.1.19
 This release delivers a broad set of improvements focused on reliability, transparency, and operational control across mail processing, administrative auditing, and Run Checks workflows. The changes aim to make message handling more robust, provide better insight for administrators, and give operators clearer and more flexible control when reviewing backup runs.