Reference

Telemetry

Logs, audit records, and OpenTelemetry export.

Moat produces four kinds of output:

Logs to stdout, for your log collector.
An audit file at <data_dir>/audit.log.
Traces over OTLP, when an endpoint is configured.
Chronicle events, which you can query and verify (see Chronicle).

OpenTelemetry

Set otel_endpoint under [server]to an OTLP collector, such as Jaeger, Grafana Tempo, or a vendor's OTLP endpoint.

moat.toml

[server]
otel_endpoint = "http://localhost:4317"

docker-compose.yml

services:
  jaeger:
    image: jaegertracing/all-in-one:latest
    ports:
      - "16686:16686"   # UI
      - "4317:4317"     # OTLP gRPC

  moat:
    image: shroudb/moat:latest
    depends_on: [jaeger]
    environment:
      MOAT_CONFIG: /etc/moat/moat.toml
      SHROUDB_MASTER_KEY: ${SHROUDB_MASTER_KEY}
    volumes:
      - ./moat.toml:/etc/moat/moat.toml:ro
      - moat-data:/data

volumes:
  moat-data:

In this setup, set otel_endpoint = "http://jaeger:4317".

Querying the audit trail

Chronicle answers questions such as “who decrypted from this keyring last week?” without you searching log files:

RESP3

CHRONICLE QUERY ENGINE cipher OP decrypt SINCE <unix-ts> LIMIT 100
CHRONICLE ACTORS
CHRONICLE ERRORS
CHRONICLE VERIFY