oz0 audit
For: Operators and developers looking up a command.
Read the audit log, newest first in its chain's order: one tenant's entries by sequence number, several tenants' by the time the database recorded them. AT is when an entry happened by the clock of whoever wrote it, and --since and --until keep the entries recorded in that time, as audit export does.
Each entry of a job tree names its starter (the person, key, routine, webhook or event source that started the tree's root job), the agent's version, the plugin and the tool where they apply.
--starter finds the entries of the job trees one principal started (user:<name>, apikey:<id>, routine:<name>, ...). It is an investigation tool, not a statistic: it takes --tenant and a --reason, the search itself is recorded in the audit log (audit.search.starter, with who searched, for whom and why), and it returns entries, never counts.
Usage
oz0 audit [flags]
oz0 audit [command]
Subcommands
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--action | string | only this action, or every action under a prefix that ends in a dot, such as node. | |
--all | bool | read every page, not one | |
--json | bool | print JSON instead of a table | |
--limit | int32 | at most this many rows a page (the server's 25 when 0, at most 100) | |
--page-token | string | go on after the page before: the token it printed | |
--reason | string | why you search by starter, recorded in the audit log (at least 10 characters) | |
--since | string | only entries recorded at or after this time (RFC 3339, or a duration ago such as 2h) | |
--starter | string | only the entries of job trees this principal started, such as user:ada (takes --tenant and --reason) | |
--target | string | only entries about this target, such as a node ID or tenant/plugin | |
--tenant | string | only this tenant's entries | |
--until | string | only entries recorded before this time (RFC 3339, or a duration ago such as 30m) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.