On Thu, 2026-08-27 at 11:10 -0700, Guenter Roeck wrote:
> Problem is that we don't know if "something bad happened". The same
> message
> will be seen if the watchdog daemon was killed or crashed. We can not
> just
> assume that closing the watchdog device was intentional.

That's the same sticking point I've come across. Differentiating
between positive intentional closure versus malicious or buggy closure
would somehow need to be communicated to the kernel. It makes more
sense that users of the watchdog which intend to close the watchdog
while still running maybe denote such. I opened a PR with systemd at
https://github.com/systemd/systemd/pull/43552 to see if there was some
way this could be tackled from that perspective.