grith log
A readable feed of decisions, historic or live, filtered to one session.
grith log [--tail] [--session <ID|NAME>] [--limit <N>]The same records as grith audit, formatted to read rather than to
export. Newest last.
$ grith log --limit 5
No logs found.Flags
| Flag | What it does |
|---|---|
--tail | Follow new entries. Polls roughly once a second and stops cleanly on Ctrl+C. |
--session <ID|NAME> | Filter to one session. Accepts a UUID or the session name from the task context. |
--limit <N> | Records per read, default 100, clamped to 1-5000. |
--limit is a clamp, not a validation: pass 0 or 100000 and you get 1 or 5000, with
no warning.
The line format
Each record is one line: a [HH:MM:SS.mmm] timestamp, then ALLOW, QUEUE or DENY
padded to five columns, then the call and its target.
Five common call types get a short label - fs.read, fs.write, fs.list,
shell.exec and http.request. Everything else keeps its full type name. The decision is
coloured green, amber and red respectively unless you pass --no-color.
ℹ️This reads the audit database
There is no separate log file. grith log is a view over the audit records, so anything
it shows is also in grith audit export, and retention applies equally.
See also
grith audit- export and integrity- Logging and audit retention - how long records live