oz0 incident link
Link an item to an incident.
For: Operators and developers looking up a command.
Link an item to an incident. KIND is one of:
job JOB a job (it is tagged incident:<id>) audit an audit range: --since and --until, or --from-seq and --to-seq (at most 50,000 entries) kill KILL-ID a kill switch receipt RCPT-ID a kill or revocation receipt egress seq:N one egress denial, by its audit seq; or --job JOB for a job's, or --since/--until finding ID an eval finding incident INC-ID another incident of the tenant
Each item is checked in the incident's tenant and keeps its time and a summary for the timeline.
Usage
oz0 incident link ID KIND [REF] [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--from-seq | int | an audit range's first entry | |
--job | string | with egress: link every egress denial of this job (at most 100) | |
--json | bool | print JSON instead of a table | |
--reason | string | why, for the audit log (required; default $OZ0_REASON) | |
--since | string | an audit range's or egress denials' start: RFC 3339, or how long ago | |
--to-seq | int | the chain's head | an audit range's last entry |
--until | string | their end (exclusive) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
--tenant | string | default | the tenant |
See all oz0 commands and the global flags.