UAC does not collect data from separately mounted filesystems beneath /var (e.g. /var, /var/log, /var/log/audit)

[zengogiri]

Describe the bug
While validating ir_triage collections, I found that the resulting output did not contain the /var or /var/log directories at all. On the affected host, /var, /var/log, and /var/log/audit are configured as separate XFS filesystems (a common hardening layout). A representative /etc/fstab looks like:

/dev/mapper/xyzvg-var       /var
/dev/mapper/xyzvg-logvol    /var/log
/dev/mapper/xyzvg-auditvol  /var/log/audit

These filesystems were confirmed present and populated with the expected log data via an independent review of a full disk image. Despite that, neither /var nor its mounted subdirectories (/var/log, /var/log/audit) appeared in the ir_triage collection output. This suggests the collection process may not be traversing into (or descending across) separately mounted filesystems beneath these paths.

To Reproduce

1. On a Linux host, place /var, /var/log, and /var/log/audit on dedicated volumes (separate mount points), e.g. as shown in the fstab above.
2. Run the triage profile:
   ./uac -p ir_triage /path/to/destination
3. Inspect the resulting archive for /var, /var/log, and /var/log/audit content (system logs, audit logs, etc.).

Expected behavior
The ir_triage collection should include /var, /var/log, and /var/log/audit and their contents (system and audit logs), regardless of whether those paths are on the root filesystem or on separately mounted volumes.

UAC Information

• Version: 3.3.0