---
title: "Inspect Diagnostics and Audit"
url: "https://docs.caracal.run/v1.0/runtime-console/observability/"
markdown_url: "https://docs.caracal.run/markdown/v1.0/runtime-console/observability.md"
description: "Read dashboard posture, diagnose service readiness, and trace authority and management decisions."
page_type: "workflow"
concepts: []
requires: []
---

# Inspect Diagnostics and Audit

Canonical URL: https://docs.caracal.run/v1.0/runtime-console/observability/
Markdown URL: https://docs.caracal.run/markdown/v1.0/runtime-console/observability.md
Description: Read dashboard posture, diagnose service readiness, and trace authority and management decisions.
Page type: workflow
Concepts: none
Requires: none

---

Start at the dashboard, then choose Diagnostics for platform posture or Audit for a specific decision.

## Read the Dashboard

The selected-zone dashboard summarizes product readiness, pending Approvals, object counts, and recent activity. Use it to decide which detail workspace to open next. A count is navigation context, not proof of correctness; verify policy with simulation and verify a real request in Audit.

## Run Diagnostics

**Diagnostics** runs shared Doctor checks across:

| Group     | What it establishes                                                              |
| --------- | -------------------------------------------------------------------------------- |
| Health    | API reachability, management authentication, and clock alignment.                |
| Readiness | Service readiness and operator metrics for STS, Gateway, Audit, and Coordinator. |
| Zones     | Visible zones, resources, active policy state, and audit queryability.           |
| Preflight | Local secrets, keys, TLS material, Postgres, and Redis reachability.             |

`caracal status --ready` answers whether the stack can accept work. Diagnostics goes deeper: policy compilation, audit integrity, event backlog, and clock skew. Treat audit chain mismatch as a security incident. Treat dead outbox rows, DLQ entries, stale pending events, and large lag as propagation failures even if HTTP health still passes.

## Trace a Request

1. Open **Audit** in the correct zone.
2. Choose **Activity** for authority/resource events or **Admin** for management changes.
3. Filter by request ID when one is available. Otherwise narrow by time, decision, event type, application, Authority record, or Session.
4. Open the event group or decision trace.
5. Read the resource, Subject, requested scopes, determining policy, diagnostics, and result.

Audit evidence and live state answer different questions. Audit shows what happened and why. Subjects, Sessions, Delegations, and Approvals show what authority remains live.

Secret reveal and rotation actions appear in admin audit. Secret values do not belong in the event payload.

## Follow Dependency Failures

| Symptom                        | First check                     | Then                                           |
| ------------------------------ | ------------------------------- | ---------------------------------------------- |
| Management pages fail          | API readiness and auth          | Postgres, Redis, and API outbox                |
| Mandate issuance fails         | STS readiness and policy state  | Postgres, Redis invalidation, keys             |
| Gateway denies before upstream | Gateway trace and STS readiness | Binding, mandate, revocation, upstream safety  |
| Audit event is delayed         | Audit readiness                 | Redis lag, pending entries, DLQ, replay volume |
| Session state is stale         | Coordinator readiness           | Postgres, Redis, outbox, lease sweepers        |

Use [Troubleshoot by Symptom](/v1.0/operations/troubleshooting/) for the canonical symptom-first workflow.

## Next Step

[Manage Runtime Authority](/v1.0/runtime-console/agents/).