CLI command
skarbiec audit summary
Read a span of the journal at a glance: how often each operation ran, which consumers acted, and which items were named most, so an unexpected consumer or a run of reads of one secret stands out.
Invocation#
skarbiec audit summary --since <iso> [--until <iso>]Purpose#
Read a span of the journal at a glance: how often each operation ran, which consumers acted, and which items were named most, so an unexpected consumer or a run of reads of one secret stands out.
Required inputs and options#
- --since is required, a UTC time of the vault's stamp form; how far back is yours to decide. --until is optional, of the same form. The span is inclusive, as audit list reads it.
Output and state effects#
- Reads the entries audit list --since --until returns and prints ok, since, until, entries (how many), and operations, consumers and items, each a list of rows with the name (op, consumer or item) and its count, most frequent first and ties in name order. An entry naming several items (extra.items) counts for each. Nothing is decrypted and the journal is not changed. POST /v1/operator/audit/summary takes since and until; Desktop's Settings → Policy shows it as Activity since.
Refusals#
- A missing --since exits 2 with `usage: audit summary --since <iso8601> [--until <iso8601>]`, and a time of another shape with `--<flag> <value> is not a UTC time of the form <now>`. A malformed journal line fails the summary as it fails audit list.