HashiCorp Vault monitor operations.

This module provides log monitoring capabilities for Vault, allowing you to receive streaming logs from the Vault server in real-time. This is particularly useful for debugging, monitoring, and operational visibility.

Monitor Features

Core Functionality

• Stream Logs: Receive real-time streaming logs from Vault server
• Log Level Control: Filter logs by severity level (debug, info, warn, error)
• Format Options: Choose between standard text and JSON log formats
• Real-time Monitoring: Continuous log streaming for operational visibility

Log Management

• Level Filtering: Control log verbosity with configurable levels
• Format Selection: Standard text or structured JSON output
• Stream Processing: Handle continuous log streams efficiently
• Drop Protection: Automatic handling when log emission exceeds processing capacity

Important Notes

Restricted Endpoint

• Must be called from the root or administrative namespace
• Requires appropriate authentication and authorization
• Not available in all Vault configurations

Performance Considerations

• High-volume log streams may impact performance
• Some log lines may be dropped if processing cannot keep up
• Consider log level filtering to reduce volume
• Monitor network bandwidth usage for remote streaming

Output Format

• Unlike most Vault APIs, this endpoint does not return JSON by default
• Returns logs in the configured Vault log format (text by default)
• Use JSON format option for structured log processing

API Compliance

Fully implements HashiCorp Vault Monitor API:

• Monitor API
• Vault Logging

Usage Examples

Basic Log Monitoring

{:ok, stream} = Vaultx.Sys.Monitor.stream_logs()

# Process log stream
Enum.each(stream, fn log_line ->
  IO.puts("LOG: #{log_line}")
end)

Debug Level Monitoring

{:ok, stream} = Vaultx.Sys.Monitor.stream_logs(log_level: "debug")

# Process debug logs
stream
|> Stream.filter(&String.contains?(&1, "DEBUG"))
|> Enum.take(100)

JSON Format Monitoring

{:ok, stream} = Vaultx.Sys.Monitor.stream_logs(
  log_level: "info",
  log_format: "json"
)

# Process structured logs
stream
|> Stream.map(&JSON.decode!/1)
|> Enum.each(fn log_entry ->
  IO.inspect(log_entry)
end)

Custom Processing

{:ok, stream} = Vaultx.Sys.Monitor.stream_logs(log_level: "warn")

# Filter and alert on warnings
stream
|> Stream.filter(&String.contains?(&1, "WARN"))
|> Enum.each(fn warning ->
  send_alert("Vault Warning: #{warning}")
end)

Log Levels

Available log levels (in order of verbosity):

• "debug": Most verbose, includes all log messages
• "info": Informational messages and above
• "warn": Warning messages and above
• "error": Error messages only

Log Formats

Available log formats:

• "standard": Human-readable text format (default)
• "json": Structured JSON format for programmatic processing

Stream Processing

The monitor endpoint returns a continuous stream of log data:

• Use Stream functions for efficient processing
• Consider buffering for batch processing
• Handle stream interruptions gracefully
• Monitor memory usage with large log volumes

Use Cases

Development and Debugging

• Real-time debugging during development
• Troubleshooting configuration issues
• Monitoring API request flows
• Investigating performance problems

Operations and Monitoring

• Centralized log aggregation
• Real-time alerting on errors
• Compliance and audit logging
• Performance monitoring and analysis

Security and Compliance

• Security event monitoring
• Audit trail collection
• Compliance reporting
• Incident response and forensics