diff --git a/app/services/realtime_audit_service.py b/app/services/realtime_audit_service.py
index 9cca199..d5e7854 100644
--- a/app/services/realtime_audit_service.py
+++ b/app/services/realtime_audit_service.py
@@ -711,14 +711,15 @@ def _analyze_qualys_audit(r):
             suggestions.append({
                 "severity": "high",
                 "title": f"LVM : VG {vg_name} a {free_gb}G libres — étendre /var/log",
-                "fix": f"⚠ SNAPSHOT LVM AVANT TOUTE ACTION (sécurité) :\n"
-                       f"sudo lvcreate -s -L 500M -n {lv_name}-snap-$(date +%Y%m%d-%H%M) /dev/{vg_name}/{lv_name}\n\n"
-                       f"Puis extension du LV :\n"
+                "fix": f"⚠ SNAPSHOT vCenter de la VM AVANT TOUTE ACTION (rollback en cas de souci)\n\n"
+                       f"1. Extension du LV :\n"
                        f"sudo lvextend -L +{extend_size}G /dev/{vg_name}/{lv_name}\n\n"
-                       f"Puis grow du FS (selon type — voir bloc LVM pour XFS/ext4) :\n"
+                       f"2. Grow du FS (selon type — voir bloc LVM ci-dessous) :\n"
                        f"sudo xfs_growfs /var/log         # si XFS\n"
                        f"sudo resize2fs /dev/{vg_name}/{lv_name}   # si ext4\n\n"
-                       f"En cas de souci, rollback via le snapshot."
+                       f"3. Vérif :\n"
+                       f"df -h /var/log\n"
+                       f"sudo systemctl restart qualys-cloud-agent"
             })
     if "cannot write file" in s_sys or "logger initialization failed" in s_sys:
         suggestions.append({