drop dbus daemon log · parse method calls + signals + service ownership · runs locally
flags PolicyKit bursts · systemd service activations · SendUnixFD hints · failed acquisitions
heuristic screener · log format varies by distro and capture tool — best-effort line parse · not definitive proof