Inspect Diagnostics and Audit
Start at the dashboard, then choose Diagnostics for platform posture or Audit for a specific decision.
Read the Dashboard
Section titled “Read the Dashboard”The selected-zone dashboard summarizes product readiness, pending Approvals, object counts, and recent activity. Use it to decide which detail workspace to open next. A count is navigation context, not proof of correctness; verify policy with simulation and verify a real request in Audit.
Run Diagnostics
Section titled “Run Diagnostics”Diagnostics runs shared Doctor checks across:
| Group | What it establishes |
|---|---|
| Health | API reachability, management authentication, and clock alignment. |
| Readiness | Service readiness and operator metrics for STS, Gateway, Audit, and Coordinator. |
| Zones | Visible zones, resources, active policy state, and audit queryability. |
| Preflight | Local secrets, keys, TLS material, Postgres, and Redis reachability. |
caracal status --ready answers whether the stack can accept work. Diagnostics goes deeper: policy compilation, audit integrity, event backlog, and clock skew. Treat audit chain mismatch as a security incident. Treat dead outbox rows, DLQ entries, stale pending events, and large lag as propagation failures even if HTTP health still passes.
Trace a Request
Section titled “Trace a Request”- Open Audit in the correct zone.
- Choose Activity for authority/resource events or Admin for management changes.
- Filter by request ID when one is available. Otherwise narrow by time, decision, event type, application, Authority record, or Session.
- Open the event group or decision trace.
- Read the resource, Subject, requested scopes, determining policy, diagnostics, and result.
Audit evidence and live state answer different questions. Audit shows what happened and why. Subjects, Sessions, Delegations, and Approvals show what authority remains live.
Secret reveal and rotation actions appear in admin audit. Secret values do not belong in the event payload.
Follow Dependency Failures
Section titled “Follow Dependency Failures”| Symptom | First check | Then |
|---|---|---|
| Management pages fail | API readiness and auth | Postgres, Redis, and API outbox |
| Mandate issuance fails | STS readiness and policy state | Postgres, Redis invalidation, keys |
| Gateway denies before upstream | Gateway trace and STS readiness | Binding, mandate, revocation, upstream safety |
| Audit event is delayed | Audit readiness | Redis lag, pending entries, DLQ, replay volume |
| Session state is stale | Coordinator readiness | Postgres, Redis, outbox, lease sweepers |
Use Troubleshoot by Symptom for the canonical symptom-first workflow.