Docs / Operations

Logs, metrics, SIEM

JSON on stdout, Prometheus /metrics, signed webhooks. Lattice does not speak syslog or SNMP.

Logs

Every process writes JSON slog to stdout (LATTICE_LOG_LEVEL). DHCP lines include node, xid, mac, ip, subnet_id, msg_type. Do not parse logs for lease truth — Postgres is the store.

systemd units inherit StandardOutput=journal:

journalctl -u lattice-dhcpd -u lattice-api -u lattice-worker -o json-pretty -n 20

Ship journald with Vector, rsyslog imjournal, or a node agent. Do not add a second log protocol inside dhcpd.

Metrics

Scrape from a private network. API and worker /metrics need Bearer off-loopback. dhcpd /metrics is loopback-only.

  • api /metrics (loopback on :8080)
  • dhcpd HTTP /metrics (loopback-only)
  • worker /metrics
  • Fleet GET /metrics (loopback open; Bearer off-loopback)

Names: Metrics. Alert on /readyz != 200, lattice_outbox_lag, lattice_pool_free near 0, lattice_dns_updates_total{result="failed"}.

SIEM

Subscribe a webhook to ipam.audit (and lease topics if you want grants). Webhooks. Failures retry with the outbox; they never roll back the write.

Overview in the console derives the same picture from Postgres every 8s.