[{"data":1,"prerenderedAt":1466},["ShallowReactive",2],{"navigation":3,"/operations/monitoring":145,"/operations/monitoring-surround":1463},[4,28,49,88,101,127],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Getting Started","/getting-started","1.getting-started/1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Working with Agents","/getting-started/working-with-agents","1.getting-started/2.working-with-agents",{"title":16,"path":17,"stem":18},"Setup a Service Provider","/getting-started/setup-service-provider","1.getting-started/3.setup-service-provider",{"title":20,"path":21,"stem":22},"Setup an Identity Provider","/getting-started/setup-identity-provider","1.getting-started/4.setup-identity-provider",{"title":24,"path":25,"stem":26},"Developers","/getting-started/developers","1.getting-started/5.developers",false,{"title":29,"icon":27,"path":30,"stem":31,"children":32,"page":27},"Guides","/guides","2.guides",[33,37,41,45],{"title":34,"path":35,"stem":36},"How It Works","/guides/how-it-works","2.guides/1.how-it-works",{"title":38,"path":39,"stem":40},"Capabilities Guide","/guides/capabilities-guide","2.guides/2.capabilities-guide",{"title":42,"path":43,"stem":44},"End-to-End Tutorial","/guides/end-to-end-tutorial","2.guides/3.end-to-end-tutorial",{"title":46,"path":47,"stem":48},"Delegation Guide","/guides/delegation-guide","2.guides/4.delegation-guide",{"title":50,"path":51,"stem":52,"children":53,"icon":27},"Ecosystem","/ecosystem","3.ecosystem/1.index",[54,56,60,64,68,72,76,80,84],{"title":55,"path":51,"stem":52},"Overview",{"title":57,"path":58,"stem":59},"grapes CLI","/ecosystem/grapes","3.ecosystem/2.grapes",{"title":61,"path":62,"stem":63},"shapes CLI","/ecosystem/shapes","3.ecosystem/3.shapes",{"title":65,"path":66,"stem":67},"escapes","/ecosystem/escapes","3.ecosystem/4.escapes",{"title":69,"path":70,"stem":71},"OpenApe Proxy","/ecosystem/proxy","3.ecosystem/5.proxy",{"title":73,"path":74,"stem":75},"OpenApe Browser","/ecosystem/browser","3.ecosystem/6.browser",{"title":77,"path":78,"stem":79},"OpenApe Auth","/ecosystem/auth","3.ecosystem/7.auth",{"title":81,"path":82,"stem":83},"OpenApe Grants","/ecosystem/grants","3.ecosystem/8.grants",{"title":85,"path":86,"stem":87},"nuxt-auth-sp","/ecosystem/nuxt-auth-sp","3.ecosystem/9.nuxt-auth-sp",{"title":89,"icon":27,"path":90,"stem":91,"children":92,"page":27},"Security","/security","4.security",[93,97],{"title":94,"path":95,"stem":96},"Compliance","/security/compliance","4.security/1.compliance",{"title":98,"path":99,"stem":100},"Threat Model","/security/threat-model","4.security/2.threat-model",{"title":102,"path":103,"stem":104,"children":105,"icon":27},"Reference","/reference","5.reference/1.index",[106,107,111,115,119,123],{"title":102,"path":103,"stem":104},{"title":108,"path":109,"stem":110},"IdP Configuration","/reference/idp-configuration","5.reference/2.idp-configuration",{"title":112,"path":113,"stem":114},"SP Configuration","/reference/sp-configuration","5.reference/3.sp-configuration",{"title":116,"path":117,"stem":118},"API Endpoints","/reference/api-endpoints","5.reference/4.api-endpoints",{"title":120,"path":121,"stem":122},"escapes Config","/reference/escapes-config","5.reference/5.escapes-config",{"title":124,"path":125,"stem":126},"Proxy Config","/reference/proxy-config","5.reference/6.proxy-config",{"title":128,"path":129,"stem":130,"children":131,"icon":27},"Operations","/operations","6.operations/1.index",[132,133,137,141],{"title":128,"path":129,"stem":130},{"title":134,"path":135,"stem":136},"Deployment","/operations/deployment","6.operations/2.deployment",{"title":138,"path":139,"stem":140},"Troubleshooting","/operations/troubleshooting","6.operations/3.troubleshooting",{"title":142,"path":143,"stem":144},"Monitoring","/operations/monitoring","6.operations/4.monitoring",{"id":146,"title":142,"body":147,"description":1456,"extension":1457,"links":1458,"meta":1459,"navigation":1460,"path":143,"seo":1461,"stem":144,"__hash__":1462},"docs/6.operations/4.monitoring.md",{"type":148,"value":149,"toc":1432},"minimark",[150,154,158,163,232,236,239,420,423,535,540,684,688,691,847,850,1031,1035,1039,1073,1077,1102,1106,1152,1156,1187,1191,1195,1267,1271,1314,1318,1320,1384,1387,1390,1394,1397,1425,1428],[151,152,142],"h1",{"id":153},"monitoring",[155,156,157],"p",{},"OpenApe produces audit logs at three levels: IdP, proxy, and escapes. All use JSONL format (one JSON object per line) for easy parsing.",[159,160,162],"h2",{"id":161},"audit-log-sources","Audit Log Sources",[164,165,166,182],"table",{},[167,168,169],"thead",{},[170,171,172,176,179],"tr",{},[173,174,175],"th",{},"Source",[173,177,178],{},"Location",[173,180,181],{},"What it logs",[183,184,185,200,218],"tbody",{},[170,186,187,194,197],{},[188,189,190],"td",{},[191,192,193],"strong",{},"IdP",[188,195,196],{},"Application logs (stdout/stderr)",[188,198,199],{},"Logins, registrations, grant decisions, agent enrollment",[170,201,202,207,215],{},[188,203,204],{},[191,205,206],{},"Proxy",[188,208,209,210,214],{},"Configurable (",[211,212,213],"code",{},"audit_log"," in TOML)",[188,216,217],{},"Every HTTP request, rule evaluation, grant requests",[170,219,220,224,229],{},[188,221,222],{},[191,223,65],{},[188,225,226],{},[211,227,228],{},"/var/log/openape/audit.log",[188,230,231],{},"Every command execution, verification results",[159,233,235],{"id":234},"escapes-audit-log","escapes Audit Log",[155,237,238],{},"Every execution attempt is logged:",[240,241,246],"pre",{"className":242,"code":243,"language":244,"meta":245,"style":245},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\"timestamp\":\"2025-01-15T10:30:00Z\",\"grant_id\":\"abc123\",\"command\":[\"systemctl\",\"restart\",\"nginx\"],\"requester\":\"agent+deploy@example.com\",\"approver\":\"admin@example.com\",\"result\":\"success\",\"exit_code\":0,\"duration_ms\":1234}\n","json","",[211,247,248],{"__ignoreMap":245},[249,250,253,257,260,264,266,269,271,275,277,280,282,285,287,289,291,294,296,298,300,303,305,308,310,313,315,317,319,322,324,326,328,331,333,336,338,341,343,345,347,350,352,354,356,359,361,363,365,368,370,372,374,377,379,381,383,386,388,390,392,395,397,399,403,405,407,410,412,414,417],"span",{"class":251,"line":252},"line",1,[249,254,256],{"class":255},"sMK4o","{",[249,258,259],{"class":255},"\"",[249,261,263],{"class":262},"spNyl","timestamp",[249,265,259],{"class":255},[249,267,268],{"class":255},":",[249,270,259],{"class":255},[249,272,274],{"class":273},"sfazB","2025-01-15T10:30:00Z",[249,276,259],{"class":255},[249,278,279],{"class":255},",",[249,281,259],{"class":255},[249,283,284],{"class":262},"grant_id",[249,286,259],{"class":255},[249,288,268],{"class":255},[249,290,259],{"class":255},[249,292,293],{"class":273},"abc123",[249,295,259],{"class":255},[249,297,279],{"class":255},[249,299,259],{"class":255},[249,301,302],{"class":262},"command",[249,304,259],{"class":255},[249,306,307],{"class":255},":[",[249,309,259],{"class":255},[249,311,312],{"class":273},"systemctl",[249,314,259],{"class":255},[249,316,279],{"class":255},[249,318,259],{"class":255},[249,320,321],{"class":273},"restart",[249,323,259],{"class":255},[249,325,279],{"class":255},[249,327,259],{"class":255},[249,329,330],{"class":273},"nginx",[249,332,259],{"class":255},[249,334,335],{"class":255},"],",[249,337,259],{"class":255},[249,339,340],{"class":262},"requester",[249,342,259],{"class":255},[249,344,268],{"class":255},[249,346,259],{"class":255},[249,348,349],{"class":273},"agent+deploy@example.com",[249,351,259],{"class":255},[249,353,279],{"class":255},[249,355,259],{"class":255},[249,357,358],{"class":262},"approver",[249,360,259],{"class":255},[249,362,268],{"class":255},[249,364,259],{"class":255},[249,366,367],{"class":273},"admin@example.com",[249,369,259],{"class":255},[249,371,279],{"class":255},[249,373,259],{"class":255},[249,375,376],{"class":262},"result",[249,378,259],{"class":255},[249,380,268],{"class":255},[249,382,259],{"class":255},[249,384,385],{"class":273},"success",[249,387,259],{"class":255},[249,389,279],{"class":255},[249,391,259],{"class":255},[249,393,394],{"class":262},"exit_code",[249,396,259],{"class":255},[249,398,268],{"class":255},[249,400,402],{"class":401},"sbssI","0",[249,404,279],{"class":255},[249,406,259],{"class":255},[249,408,409],{"class":262},"duration_ms",[249,411,259],{"class":255},[249,413,268],{"class":255},[249,415,416],{"class":401},"1234",[249,418,419],{"class":255},"}\n",[155,421,422],{},"Failed attempts include error details:",[240,424,426],{"className":242,"code":425,"language":244,"meta":245,"style":245},"{\"timestamp\":\"2025-01-15T10:31:00Z\",\"error\":\"cmd_hash mismatch\",\"command\":[\"rm\",\"-rf\",\"/\"],\"requester\":\"agent+deploy@example.com\",\"result\":\"verification_failed\"}\n",[211,427,428],{"__ignoreMap":245},[249,429,430,432,434,436,438,440,442,445,447,449,451,454,456,458,460,463,465,467,469,471,473,475,477,480,482,484,486,489,491,493,495,498,500,502,504,506,508,510,512,514,516,518,520,522,524,526,528,531,533],{"class":251,"line":252},[249,431,256],{"class":255},[249,433,259],{"class":255},[249,435,263],{"class":262},[249,437,259],{"class":255},[249,439,268],{"class":255},[249,441,259],{"class":255},[249,443,444],{"class":273},"2025-01-15T10:31:00Z",[249,446,259],{"class":255},[249,448,279],{"class":255},[249,450,259],{"class":255},[249,452,453],{"class":262},"error",[249,455,259],{"class":255},[249,457,268],{"class":255},[249,459,259],{"class":255},[249,461,462],{"class":273},"cmd_hash mismatch",[249,464,259],{"class":255},[249,466,279],{"class":255},[249,468,259],{"class":255},[249,470,302],{"class":262},[249,472,259],{"class":255},[249,474,307],{"class":255},[249,476,259],{"class":255},[249,478,479],{"class":273},"rm",[249,481,259],{"class":255},[249,483,279],{"class":255},[249,485,259],{"class":255},[249,487,488],{"class":273},"-rf",[249,490,259],{"class":255},[249,492,279],{"class":255},[249,494,259],{"class":255},[249,496,497],{"class":273},"/",[249,499,259],{"class":255},[249,501,335],{"class":255},[249,503,259],{"class":255},[249,505,340],{"class":262},[249,507,259],{"class":255},[249,509,268],{"class":255},[249,511,259],{"class":255},[249,513,349],{"class":273},[249,515,259],{"class":255},[249,517,279],{"class":255},[249,519,259],{"class":255},[249,521,376],{"class":262},[249,523,259],{"class":255},[249,525,268],{"class":255},[249,527,259],{"class":255},[249,529,530],{"class":273},"verification_failed",[249,532,259],{"class":255},[249,534,419],{"class":255},[536,537,539],"h3",{"id":538},"fields","Fields",[164,541,542,555],{},[167,543,544],{},[170,545,546,549,552],{},[173,547,548],{},"Field",[173,550,551],{},"Type",[173,553,554],{},"Description",[183,556,557,571,584,598,611,624,644,658,671],{},[170,558,559,563,568],{},[188,560,561],{},[211,562,263],{},[188,564,565],{},[211,566,567],{},"string",[188,569,570],{},"ISO 8601",[170,572,573,577,581],{},[188,574,575],{},[211,576,284],{},[188,578,579],{},[211,580,567],{},[188,582,583],{},"Grant UUID",[170,585,586,590,595],{},[188,587,588],{},[211,589,302],{},[188,591,592],{},[211,593,594],{},"string[]",[188,596,597],{},"Command that was (or would have been) executed",[170,599,600,604,608],{},[188,601,602],{},[211,603,340],{},[188,605,606],{},[211,607,567],{},[188,609,610],{},"Agent email",[170,612,613,617,621],{},[188,614,615],{},[211,616,358],{},[188,618,619],{},[211,620,567],{},[188,622,623],{},"Who approved the grant",[170,625,626,630,634],{},[188,627,628],{},[211,629,376],{},[188,631,632],{},[211,633,567],{},[188,635,636,638,639,638,641],{},[211,637,385],{},", ",[211,640,530],{},[211,642,643],{},"exec_failed",[170,645,646,650,655],{},[188,647,648],{},[211,649,394],{},[188,651,652],{},[211,653,654],{},"number",[188,656,657],{},"Command exit code",[170,659,660,664,668],{},[188,661,662],{},[211,663,409],{},[188,665,666],{},[211,667,654],{},[188,669,670],{},"Execution time",[170,672,673,677,681],{},[188,674,675],{},[211,676,453],{},[188,678,679],{},[211,680,567],{},[188,682,683],{},"Error message (on failure)",[159,685,687],{"id":686},"proxy-audit-log","Proxy Audit Log",[155,689,690],{},"Every request through the proxy is logged:",[240,692,694],{"className":242,"code":693,"language":244,"meta":245,"style":245},"{\"ts\":\"2025-01-15T10:30:00.123Z\",\"agent\":\"agent+deploy@example.com\",\"action\":\"allow\",\"domain\":\"api.github.com\",\"method\":\"GET\",\"path\":\"/repos/org/repo\",\"grant_id\":null,\"rule\":\"allow[0]\",\"waited_ms\":0}\n",[211,695,696],{"__ignoreMap":245},[249,697,698,700,702,705,707,709,711,714,716,718,720,723,725,727,729,731,733,735,737,740,742,744,746,749,751,753,755,758,760,762,764,767,769,771,773,776,778,780,782,785,787,789,791,794,796,798,800,803,805,807,809,811,813,816,818,821,823,825,827,830,832,834,836,839,841,843,845],{"class":251,"line":252},[249,699,256],{"class":255},[249,701,259],{"class":255},[249,703,704],{"class":262},"ts",[249,706,259],{"class":255},[249,708,268],{"class":255},[249,710,259],{"class":255},[249,712,713],{"class":273},"2025-01-15T10:30:00.123Z",[249,715,259],{"class":255},[249,717,279],{"class":255},[249,719,259],{"class":255},[249,721,722],{"class":262},"agent",[249,724,259],{"class":255},[249,726,268],{"class":255},[249,728,259],{"class":255},[249,730,349],{"class":273},[249,732,259],{"class":255},[249,734,279],{"class":255},[249,736,259],{"class":255},[249,738,739],{"class":262},"action",[249,741,259],{"class":255},[249,743,268],{"class":255},[249,745,259],{"class":255},[249,747,748],{"class":273},"allow",[249,750,259],{"class":255},[249,752,279],{"class":255},[249,754,259],{"class":255},[249,756,757],{"class":262},"domain",[249,759,259],{"class":255},[249,761,268],{"class":255},[249,763,259],{"class":255},[249,765,766],{"class":273},"api.github.com",[249,768,259],{"class":255},[249,770,279],{"class":255},[249,772,259],{"class":255},[249,774,775],{"class":262},"method",[249,777,259],{"class":255},[249,779,268],{"class":255},[249,781,259],{"class":255},[249,783,784],{"class":273},"GET",[249,786,259],{"class":255},[249,788,279],{"class":255},[249,790,259],{"class":255},[249,792,793],{"class":262},"path",[249,795,259],{"class":255},[249,797,268],{"class":255},[249,799,259],{"class":255},[249,801,802],{"class":273},"/repos/org/repo",[249,804,259],{"class":255},[249,806,279],{"class":255},[249,808,259],{"class":255},[249,810,284],{"class":262},[249,812,259],{"class":255},[249,814,815],{"class":255},":null,",[249,817,259],{"class":255},[249,819,820],{"class":262},"rule",[249,822,259],{"class":255},[249,824,268],{"class":255},[249,826,259],{"class":255},[249,828,829],{"class":273},"allow[0]",[249,831,259],{"class":255},[249,833,279],{"class":255},[249,835,259],{"class":255},[249,837,838],{"class":262},"waited_ms",[249,840,259],{"class":255},[249,842,268],{"class":255},[249,844,402],{"class":401},[249,846,419],{"class":255},[536,848,539],{"id":849},"fields-1",[164,851,852,862],{},[167,853,854],{},[170,855,856,858,860],{},[173,857,548],{},[173,859,551],{},[173,861,554],{},[183,863,864,877,889,917,930,943,956,970,989,1002,1016],{},[170,865,866,870,874],{},[188,867,868],{},[211,869,704],{},[188,871,872],{},[211,873,567],{},[188,875,876],{},"ISO 8601 with milliseconds",[170,878,879,883,887],{},[188,880,881],{},[211,882,722],{},[188,884,885],{},[211,886,567],{},[188,888,610],{},[170,890,891,895,899],{},[188,892,893],{},[211,894,739],{},[188,896,897],{},[211,898,567],{},[188,900,901,638,903,638,906,638,909,638,912,638,915],{},[211,902,748],{},[211,904,905],{},"deny",[211,907,908],{},"grant_approved",[211,910,911],{},"grant_denied",[211,913,914],{},"grant_timeout",[211,916,453],{},[170,918,919,923,927],{},[188,920,921],{},[211,922,757],{},[188,924,925],{},[211,926,567],{},[188,928,929],{},"Target domain",[170,931,932,936,940],{},[188,933,934],{},[211,935,775],{},[188,937,938],{},[211,939,567],{},[188,941,942],{},"HTTP method",[170,944,945,949,953],{},[188,946,947],{},[211,948,793],{},[188,950,951],{},[211,952,567],{},[188,954,955],{},"Request path",[170,957,958,962,967],{},[188,959,960],{},[211,961,284],{},[188,963,964],{},[211,965,966],{},"string | null",[188,968,969],{},"Associated grant ID (if grant_required rule matched)",[170,971,972,976,980],{},[188,973,974],{},[211,975,820],{},[188,977,978],{},[211,979,567],{},[188,981,982,983,638,985,988],{},"Which rule matched (e.g., ",[211,984,829],{},[211,986,987],{},"deny[2]",")",[170,990,991,995,999],{},[188,992,993],{},[211,994,838],{},[188,996,997],{},[211,998,654],{},[188,1000,1001],{},"Time spent waiting for grant approval",[170,1003,1004,1009,1013],{},[188,1005,1006],{},[211,1007,1008],{},"request_hash",[188,1010,1011],{},[211,1012,567],{},[188,1014,1015],{},"Request fingerprint for deduplication",[170,1017,1018,1022,1026],{},[188,1019,1020],{},[211,1021,453],{},[188,1023,1024],{},[211,1025,567],{},[188,1027,1028,1029,988],{},"Error message (if action is ",[211,1030,453],{},[159,1032,1034],{"id":1033},"querying-logs","Querying Logs",[536,1036,1038],{"id":1037},"find-all-denied-grants","Find all denied grants",[240,1040,1044],{"className":1041,"code":1042,"language":1043,"meta":245,"style":245},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","grep '\"action\":\"deny\"' /var/log/openape-proxy/audit.jsonl | jq .\n","bash",[211,1045,1046],{"__ignoreMap":245},[249,1047,1048,1052,1055,1058,1061,1064,1067,1070],{"class":251,"line":252},[249,1049,1051],{"class":1050},"sBMFI","grep",[249,1053,1054],{"class":255}," '",[249,1056,1057],{"class":273},"\"action\":\"deny\"",[249,1059,1060],{"class":255},"'",[249,1062,1063],{"class":273}," /var/log/openape-proxy/audit.jsonl",[249,1065,1066],{"class":255}," |",[249,1068,1069],{"class":1050}," jq",[249,1071,1072],{"class":273}," .\n",[536,1074,1076],{"id":1075},"find-failed-escapes-executions","Find failed escapes executions",[240,1078,1080],{"className":1041,"code":1079,"language":1043,"meta":245,"style":245},"grep '\"result\":\"verification_failed\"' /var/log/openape/audit.log | jq .\n",[211,1081,1082],{"__ignoreMap":245},[249,1083,1084,1086,1088,1091,1093,1096,1098,1100],{"class":251,"line":252},[249,1085,1051],{"class":1050},[249,1087,1054],{"class":255},[249,1089,1090],{"class":273},"\"result\":\"verification_failed\"",[249,1092,1060],{"class":255},[249,1094,1095],{"class":273}," /var/log/openape/audit.log",[249,1097,1066],{"class":255},[249,1099,1069],{"class":1050},[249,1101,1072],{"class":273},[536,1103,1105],{"id":1104},"count-requests-per-agent","Count requests per agent",[240,1107,1109],{"className":1041,"code":1108,"language":1043,"meta":245,"style":245},"cat /var/log/openape-proxy/audit.jsonl | jq -r '.agent' | sort | uniq -c | sort -rn\n",[211,1110,1111],{"__ignoreMap":245},[249,1112,1113,1116,1118,1120,1122,1125,1127,1130,1132,1134,1137,1139,1142,1145,1147,1149],{"class":251,"line":252},[249,1114,1115],{"class":1050},"cat",[249,1117,1063],{"class":273},[249,1119,1066],{"class":255},[249,1121,1069],{"class":1050},[249,1123,1124],{"class":273}," -r",[249,1126,1054],{"class":255},[249,1128,1129],{"class":273},".agent",[249,1131,1060],{"class":255},[249,1133,1066],{"class":255},[249,1135,1136],{"class":1050}," sort",[249,1138,1066],{"class":255},[249,1140,1141],{"class":1050}," uniq",[249,1143,1144],{"class":273}," -c",[249,1146,1066],{"class":255},[249,1148,1136],{"class":1050},[249,1150,1151],{"class":273}," -rn\n",[536,1153,1155],{"id":1154},"find-all-actions-by-a-specific-agent","Find all actions by a specific agent",[240,1157,1159],{"className":1041,"code":1158,"language":1043,"meta":245,"style":245},"grep 'agent+deploy@example.com' /var/log/openape-proxy/audit.jsonl | jq -c '{ts, action, domain, method}'\n",[211,1160,1161],{"__ignoreMap":245},[249,1162,1163,1165,1167,1169,1171,1173,1175,1177,1179,1181,1184],{"class":251,"line":252},[249,1164,1051],{"class":1050},[249,1166,1054],{"class":255},[249,1168,349],{"class":273},[249,1170,1060],{"class":255},[249,1172,1063],{"class":273},[249,1174,1066],{"class":255},[249,1176,1069],{"class":1050},[249,1178,1144],{"class":273},[249,1180,1054],{"class":255},[249,1182,1183],{"class":273},"{ts, action, domain, method}",[249,1185,1186],{"class":255},"'\n",[159,1188,1190],{"id":1189},"alerting-recommendations","Alerting Recommendations",[536,1192,1194],{"id":1193},"critical-alerts","Critical Alerts",[164,1196,1197,1210],{},[167,1198,1199],{},[170,1200,1201,1204,1207],{},[173,1202,1203],{},"Condition",[173,1205,1206],{},"What it means",[173,1208,1209],{},"Query",[183,1211,1212,1229,1243,1256],{},[170,1213,1214,1220,1223],{},[188,1215,1216,1217,1219],{},"Multiple ",[211,1218,530],{}," from same agent",[188,1221,1222],{},"Possible key compromise or misconfiguration",[188,1224,1225,1228],{},[211,1226,1227],{},"result == \"verification_failed\""," count > 5 in 1h",[170,1230,1231,1235,1238],{},[188,1232,1233],{},[211,1234,462],{},[188,1236,1237],{},"Someone is trying to run a different command than approved",[188,1239,1240],{},[211,1241,1242],{},"error contains \"cmd_hash\"",[170,1244,1245,1248,1251],{},[188,1246,1247],{},"Unknown agent email in logs",[188,1249,1250],{},"Unauthorized agent attempting access",[188,1252,1253],{},[211,1254,1255],{},"agent not in known_agents",[170,1257,1258,1261,1264],{},[188,1259,1260],{},"Management Token used from unexpected IP",[188,1262,1263],{},"Possible token leak",[188,1265,1266],{},"IdP access logs",[536,1268,1270],{"id":1269},"warning-alerts","Warning Alerts",[164,1272,1273,1281],{},[167,1274,1275],{},[170,1276,1277,1279],{},[173,1278,1203],{},[173,1280,1206],{},[183,1282,1283,1293,1303],{},[170,1284,1285,1290],{},[188,1286,1287,1288],{},"High volume of ",[211,1289,914],{},[188,1291,1292],{},"Approvers not responding to grant requests",[170,1294,1295,1300],{},[188,1296,1297,1299],{},[211,1298,905],{}," rate > 50%",[188,1301,1302],{},"Rules may be too restrictive, or agents misconfigured",[170,1304,1305,1311],{},[188,1306,1307,1310],{},[211,1308,1309],{},"once"," grants created but never consumed",[188,1312,1313],{},"Agents requesting but not using grants",[159,1315,1317],{"id":1316},"log-rotation","Log Rotation",[536,1319,65],{"id":65},[240,1321,1323],{"className":1041,"code":1322,"language":1043,"meta":245,"style":245},"# logrotate config: /etc/logrotate.d/openape\n/var/log/openape/audit.log {\n    daily\n    rotate 90\n    compress\n    delaycompress\n    missingok\n    notifempty\n}\n",[211,1324,1325,1331,1339,1345,1354,1360,1366,1372,1378],{"__ignoreMap":245},[249,1326,1327],{"class":251,"line":252},[249,1328,1330],{"class":1329},"sHwdD","# logrotate config: /etc/logrotate.d/openape\n",[249,1332,1334,1336],{"class":251,"line":1333},2,[249,1335,228],{"class":1050},[249,1337,1338],{"class":273}," {\n",[249,1340,1342],{"class":251,"line":1341},3,[249,1343,1344],{"class":1050},"    daily\n",[249,1346,1348,1351],{"class":251,"line":1347},4,[249,1349,1350],{"class":1050},"    rotate",[249,1352,1353],{"class":401}," 90\n",[249,1355,1357],{"class":251,"line":1356},5,[249,1358,1359],{"class":1050},"    compress\n",[249,1361,1363],{"class":251,"line":1362},6,[249,1364,1365],{"class":1050},"    delaycompress\n",[249,1367,1369],{"class":251,"line":1368},7,[249,1370,1371],{"class":1050},"    missingok\n",[249,1373,1375],{"class":251,"line":1374},8,[249,1376,1377],{"class":1050},"    notifempty\n",[249,1379,1381],{"class":251,"line":1380},9,[249,1382,419],{"class":1383},"sTEyZ",[536,1385,206],{"id":1386},"proxy",[155,1388,1389],{},"Configure rotation for the proxy audit log similarly, or pipe to a log aggregation service (Datadog, Loki, etc.).",[159,1391,1393],{"id":1392},"integration-with-log-aggregation","Integration with Log Aggregation",[155,1395,1396],{},"JSONL format is directly compatible with:",[1398,1399,1400,1407,1413,1419],"ul",{},[1401,1402,1403,1406],"li",{},[191,1404,1405],{},"Datadog"," — use the file tailing agent",[1401,1408,1409,1412],{},[191,1410,1411],{},"Grafana Loki"," — use promtail with JSON parsing",[1401,1414,1415,1418],{},[191,1416,1417],{},"ELK Stack"," — use Filebeat with JSON input",[1401,1420,1421,1424],{},[191,1422,1423],{},"CloudWatch"," — pipe to CloudWatch Logs agent",[155,1426,1427],{},"Each JSONL entry is a self-contained JSON object, so no multi-line parsing is needed.",[1429,1430,1431],"style",{},"html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}",{"title":245,"searchDepth":1341,"depth":1333,"links":1433},[1434,1435,1438,1441,1447,1451,1455],{"id":161,"depth":1333,"text":162},{"id":234,"depth":1333,"text":235,"children":1436},[1437],{"id":538,"depth":1341,"text":539},{"id":686,"depth":1333,"text":687,"children":1439},[1440],{"id":849,"depth":1341,"text":539},{"id":1033,"depth":1333,"text":1034,"children":1442},[1443,1444,1445,1446],{"id":1037,"depth":1341,"text":1038},{"id":1075,"depth":1341,"text":1076},{"id":1104,"depth":1341,"text":1105},{"id":1154,"depth":1341,"text":1155},{"id":1189,"depth":1333,"text":1190,"children":1448},[1449,1450],{"id":1193,"depth":1341,"text":1194},{"id":1269,"depth":1341,"text":1270},{"id":1316,"depth":1333,"text":1317,"children":1452},[1453,1454],{"id":65,"depth":1341,"text":65},{"id":1386,"depth":1341,"text":206},{"id":1392,"depth":1333,"text":1393},"Audit logs, log formats, and alerting recommendations.","md",null,{},true,{"title":142,"description":1456},"VU2kFjpWNPuCfIirJQTxrRsWR9tlZ1tLvpfZeLbfKRQ",[1464,1458],{"title":138,"path":139,"stem":140,"description":1465,"children":-1},"Common errors and their solutions.",1774221117377]