crab audit
Inspect and verify the local audit event log.
Synopsis
crab audit <SUBCOMMAND> [OPTIONS]The log defaults to .crab/audit/events.jsonl. Audit events cover important
local operations such as release, recovery, authentication, replication, and
storage administration.
Subcommands
| Command | Purpose |
|---|---|
crab audit log | List events, optionally filtered by operation |
crab audit verify | Verify event schema and digest links |
crab audit export | Write a portable JSON bundle |
Options
log and verify accept --path <PATH> and --json. log and export also
accept --operation <OP>. export requires --output <PATH>.
Examples
crab audit log
crab audit log --operation release.publish --json
crab audit verify --path .crab/audit/events.jsonl
crab audit export --output audit.jsonRun verify before exporting evidence or using it in an incident review. It
checks both the event schema and the digest chain, so a syntactically readable
JSONL file can still fail verification if records were removed or changed.
export creates a portable bundle; it does not repair the source log. Preserve
the original JSONL file when verification fails, then collect
crab logs and the installed version before
investigating further.