> For the complete documentation index, see [llms.txt](https://docs.bluerock.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bluerock.io/bluerock-sandbox/bluerock-sandbox-observability.md). # BlueRock Sandbox Observability The BlueRock Sandbox logs execution events and system activity to a local file. Reviewing these logs provides immediate visibility into authorized and unauthorized application behavior. ### Specifying the Log File By default, the sandbox writes all activity to a file named `BRace.log` (or `sandbox.log` depending on the alias) in the current working directory. To specify a custom location or filename, use the `-l` or `--logfile` parameter during execution. {% code overflow="wrap" %} ```shellscript $ brace -l ./custom_sandbox.log -v /usr:/usr:ro -v /lib:/lib:ro -v /lib64:/lib64:ro -- /usr/bin/bash ``` {% endcode %} To stream logs directly to the terminal for real-time observation, specify `stdout`: {% code overflow="wrap" %} ```shellscript $ brace -l stdout -v /usr:/usr -v /lib:/lib -v /lib64:/lib64 -v /dev:/dev -v /home/ubuntu:/home/ubuntu --name sandbox_exec -- /usr/bin/bash ``` {% endcode %} Expected output: {% code overflow="wrap" lineNumbers="true" %} ```shellscript 2026-07-06T07:40:51.382787732Z INFO main acoustic::connector: acoustic/src/connector.rs:36: Using socket paths: "/run/bluerock/sensor.sock", None, None 2026-07-06T07:40:51.422742416Z INFO main brace::runtime::common::opts: brace/src/runtime/common/opts.rs:167: Final opts after CLI overrides - pid_ns: true, user_ns: false 2026-07-06T07:40:51.424553402Z INFO ThreadId(03) brace::runtime::common::seccomp_monitor: brace/src/runtime/common/seccomp_monitor.rs:126: Starting seccomp monitoring for container PID 26068 2026-07-06T07:40:51.42484236Z INFO main brace::capability: brace/src/capability.rs:113: Ambient capabilities (will survive exec): [CAP_NET_RAW, CAP_SYS_ADMIN] 2026-07-06T07:40:51.428134288Z INFO main brace::capability: brace/src/capability.rs:160: Dropped CAP_SYS_ADMIN capability after mount operations 2026-07-06T07:40:51.42815227Z INFO main brace::capability: brace/src/capability.rs:179: Dropped temporal capabilities: network=false, mount=true ``` {% endcode %} ### Viewing Sandbox Logs Standard Linux utilities can be used to monitor and review the generated log files. To view the entire log file: {% code overflow="wrap" %} ```shellscript $ cat custom_sandbox_rCURRENT.log ``` {% endcode %} Example output: {% code overflow="wrap" lineNumbers="true" %} ```shellscript 2026-07-06T07:10:32.897809038Z INFO main acoustic::connector: acoustic/src/connector.rs:36: Using socket paths: "/run/bluerock/sensor.sock", None, None 2026-07-06T07:10:32.943514108Z INFO main brace::runtime::common::opts: brace/src/runtime/common/opts.rs:167: Final opts after CLI overrides - pid_ns: true, user_ns: false 2026-07-06T07:10:32.945115444Z INFO ThreadId(04) brace::runtime::common::seccomp_monitor: brace/src/runtime/common/seccomp_monitor.rs:126: Starting seccomp monitoring for container PID 25879 2026-07-06T07:10:32.94562813Z INFO main brace::capability: brace/src/capability.rs:113: Ambient capabilities (will survive exec): [CAP_SYS_ADMIN, CAP_NET_RAW] 2026-07-06T07:10:32.948816335Z INFO main brace::capability: brace/src/capability.rs:160: Dropped CAP_SYS_ADMIN capability after mount operations 2026-07-06T07:10:32.948830821Z INFO main brace::capability: brace/src/capability.rs:179: Dropped temporal capabilities: network=false, mount=true 2026-07-06T07:10:59.896610887Z INFO ThreadId(04) brace::runtime::common::seccomp_monitor: brace/src/runtime/common/seccomp_monitor.rs:141: Seccomp monitor: all container processes (init PID 25879) exited 2026-07-06T07:10:59.896647653Z INFO ThreadId(04) brace::runtime::common::seccomp_monitor: brace/src/runtime/common/seccomp_monitor.rs:465: Seccomp monitoring stopped for container PID 25879 ``` {% endcode %} To monitor logs in real-time (follow mode): ```shellscript $ tail -f custom_sandbox_rCURRENT.log ``` Expected output: {% code overflow="wrap" lineNumbers="true" %} ```shellscript 2026-07-06T07:10:32.897809038Z INFO main acoustic::connector: acoustic/src/connector.rs:36: Using socket paths: "/run/bluerock/sensor.sock", None, None 2026-07-06T07:10:32.943514108Z INFO main brace::runtime::common::opts: brace/src/runtime/common/opts.rs:167: Final opts after CLI overrides - pid_ns: true, user_ns: false 2026-07-06T07:10:32.945115444Z INFO ThreadId(04) brace::runtime::common::seccomp_monitor: brace/src/runtime/common/seccomp_monitor.rs:126: Starting seccomp monitoring for container PID 25879 2026-07-06T07:10:32.94562813Z INFO main brace::capability: brace/src/capability.rs:113: Ambient capabilities (will survive exec): [CAP_SYS_ADMIN, CAP_NET_RAW] 2026-07-06T07:10:32.948816335Z INFO main brace::capability: brace/src/capability.rs:160: Dropped CAP_SYS_ADMIN capability after mount operations 2026-07-06T07:10:32.948830821Z INFO main brace::capability: brace/src/capability.rs:179: Dropped temporal capabilities: network=false, mount=true 2026-07-06T07:10:59.896610887Z INFO ThreadId(04) brace::runtime::common::seccomp_monitor: brace/src/runtime/common/seccomp_monitor.rs:141: Seccomp monitor: all container processes (init PID 25879) exited 2026-07-06T07:10:59.896647653Z INFO ThreadId(04) brace::runtime::common::seccomp_monitor: brace/src/runtime/common/seccomp_monitor.rs:465: Seccomp monitoring stopped for container PID 25879 ``` {% endcode %} {% hint style="info" icon="notes-sticky" %} **Note:** BlueRock Sandbox always creates a log file with `_rCURRENT.log` that always capture the current actions/logs happening in the sandbox. By default `BRace_rCURRENT.log` is present that monitors all the current logs. {% endhint %} ### Understanding Log Entries Telemetry and monitoring logs are time-stamped entries indicating the initialization, process transitions, and structural state changes of a sandboxed instance. When launching a workload via the standalone CLI interface, the engine utilizes a dynamic trailing format (e.g., `custom_sandbox_rCURRENT.log`) to record active system setups, namespace flags, and capability limits. #### Runtime Logs The stream below illustrates a focused snapshot of a successful sandbox boot sequence initialization phase: ```shellscript 2026-07-06T07:10:32.897809038Z INFO main acoustic::connector: Using socket paths: "/run/bluerock/sensor.sock", None, None 2026-07-06T07:10:32.943514108Z INFO main brace::runtime::common::opts: Final opts after CLI overrides - pid_ns: true, user_ns: false 2026-07-06T07:10:32.945115444Z INFO ThreadId(04) brace::runtime::common::seccomp_monitor: Starting seccomp monitoring for container PID 25879 ``` #### Log Stream * Socket Binding (`acoustic::connector`): Confirms connection initialization over the host daemon path (`/run/bluerock/sensor.sock`) to dispatch active event tracking data blocks. * Namespace Overrides (`brace::runtime::common::opts`): Logs the final namespace configuration state (e.g., enabling isolated PID namespaces with `pid_ns: true`) applied to the sandbox layer after processing CLI input switches. * Seccomp Hook Initialization (`seccomp_monitor`): Indicates the runtime successfully spawned a dedicated monitoring thread (`ThreadId(04)`) to intercept and evaluate system calls for the container target (`PID 25879`). ### OpenTelemetry (OTEL) Event Collection 1. Restart the `otelcol.service` to load the OTEL Collector. ```shell ## To restart the otelcol.service $ sudo systemctl restart otelcol.service ## To check the status of otelcol.service $ sudo systemctl status otelcol.service ``` 2. To check the logs 
$ journalctl -u otelcol.service
Expected output: ```shellscript Jul 05 19:33:45 ip-172-31-25-81 systemd[1]: Started otelcol.service - OpenTelemetry Collector (Bluerock). Jul 05 19:33:45 ip-172-31-25-81 run-otelcol.sh[2628]: 2026/07/05 19:33:45 ADOT Collector version: v0.44.0 Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026/07/05 19:33:46 attn: users of the `datadog`, `logzio`, `sapm`, `signalfx` exporter components. please refer to https://github.com/> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.311Z info service@v0.130.0/service.go:197 Setting up own telemetry... {"resource": {"se> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.318Z info builders/builders.go:26 Development component. May change in the future. {"re> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.325Z info builders/builders.go:26 Unmaintained component. Actively looking for contributors. C> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.325Z debug awsutil@v0.130.0/conn.go:26 Using proxy address: {"resource": {"service.ins> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.326Z debug awsutil@v0.130.0/conn.go:98 Fetch region from commandline/config file {"reso> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug builders/builders.go:24 Beta component. May change in the future. {"resource> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug builders/builders.go:24 Stable component. {"resource": {"service.instance.id> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug Logger core does not support injecting component attributes {"resource": {"service.> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug otlpreceiver@v0.130.0/otlp.go:58 created signal-agnostic logger {"resource":> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug builders/builders.go:24 Beta component. May change in the future. {"resource> ``` *** ### Advanced OpenTelemetry (OTEL) Event Routing #### **Understanding the OTEL Data Flow** Standard sandbox execution logs reside locally in `otel-events.log` resides at `/var/log/bluerockd`. The OpenTelemetry (OTEL) Collector does not store execution events locally. The local `otelcol.service` acts as a telemetry pipeline. The pipeline receives raw data from the BlueRock sensor, enriches the data with cloud provider metadata, and immediately exports the data to a centralized cloud observability platform. Checking `sudo systemctl status otelcol.service` only displays internal service logs, such as startup events and memory limiter configurations. Viewing actual sandbox policy violations and execution traces requires querying the configured export destination or enabling local debugging. *** ### **Viewing OTEL Events** The OTEL Collector exports telemetry data directly to the centralized observability platform of the active cloud provider. #### **Viewing Events in Amazon Web Services (AWS)** During AWS EC2 deployments, the BlueRock OTEL collector is configured to use the `awscloudwatchlogs` exporter. Successful telemetry routing requires assigning an appropriate IAM Instance Profile to the deployment node to authorize CloudWatch ingestion. * **Destination:** Amazon CloudWatch Logs * **Enrichment:** Events are automatically structured and tagged by the OpenTelemetry pipeline before ingestion. **Querying the Logs:** 1. Access the AWS Management Console. 2. Navigate to **CloudWatch** > **Logs** > **Log Management**. 3. Locate and select the log group created by the deployment (for example: `bluerock-ec2-TelemetryLogGroup`). 4. Select the active log stream to view the live telemetry. 5. Use the Filter events search bar to query for specific event types (e.g., type `"process_guard_violation"` to filter for blocked execution attempts).\ ![](/files/Ugh0f4hzfFZtXElptvbU) **Example OTEL Event Payload (AWS):**\ Exported OpenTelemetry events use structured JSON payloads. Below is an example of a blocked execution attempt as it appears in CloudWatch: ```json { "body": { "source_event": { "args": "wget --timeout xx -U wget/x.xx.x-xxxxxxxxxx Ubuntu/xx.xx.x/LTS GNU/Linux/x.xx.xx-bluerock-bru-release-xx-xx-x-xxxxxxxxxxxx/x86_64 Intel(R)/Xeon(R)/Platinum/xxxxxx/CPU/@/xxxxGHz cloud_id/xxx -O- --content-on-error https://motd.ubuntu.com", "context": { "cgroup": { "cgroup_id": 00000, "cgroup_name": "/system.slice/motd-news.service" }, "namespace": { "cgroup_ns_inum": 0000000000, "ipc_ns_inum": 0000000000, "mnt_ns_inum": 0000000000, "net_ns_inum": 0000000000, "pid_for_children_ns_inum": 0000000000, "pid_ns_inum": 0000000000, "time_for_children_ns_inum": 0000000000, "time_ns_inum": 0000000000, "user_ns_inum": 0000000000, "uts_ns_inum": 0000000000 }, "parent_process": { "comm": "50-motd-news", "pid": 00000 }, "process": { "comm": "50-motd-news", "cwd": "/", "effective_capability": 2199023255551, "egid": 0, "euid": 0, "file_path": "/usr/bin/dash", "gid": 0, "permitted_capability": 2199023255551, "pid": 00000, "sys_daemon": true, "uid": 0 } }, "env": "USER=root SYSTEMD_EXEC_PID=00000 TRIGGER_TIMER_REALTIME_USEC=0000000000000000 JOURNAL_STREAM=x:xxxxx MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/motd-news.service/memory.pressure PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/snap/bin INVOCA", "fd0": "CHARDEV: /dev/null", "fd1": "UNKNOWN: /tmp/tmp.xxxxxxxxxx", "fd2": "UNKNOWN: /tmp/tmp.xxxxxxxxxx", "file_path": "/usr/bin/wget", "meta": { "name": "process_exec", "origin": "kernel", "sensor_id": 0000, "source_event_id": 0000000, "type": "event" }, "newfile": false, "newfile_arg": false } }, "severity_number": 13, "severity_text": "WARN", "attributes": { "description": "'/usr/bin/dash' attemping to execute '/usr/bin/wget'. '/usr/bin/dash' is not allowed to execute.", "domain": "gyro", "event_name": "process_guard_violation", "hostid": "ip-xxx-xx-xx-xxx", "origin": "uc-gyro", "sensor_id": 0000, "source_event_id": 0000000, "type": "log" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` *** #### **Viewing Events Locally via OTEL Exporter** By default, the OTEL Collector routes telemetry data to external platforms and does not print event payloads to the local console. Viewing events directly within the `otel-collector` container logs requires enabling the debug exporter. The debug exporter is a built-in OTEL component designed specifically to print telemetry data directly to the local standard output. Enabling the debug exporter verifies data ingestion and allows inspection of raw JSON payloads before network transmission. 1. **Modify the OTEL Configuration**\ Edit the configuration file located at `/opt/bluerock/otel/otel-config.yaml` to include the `debug` exporter.\ \ Add the `debug` exporter under the `exporters` section: 
exporters:
     awscloudwatchlogs:
       log_group_name: bluerock-ec2-TelemetryLogGroup
     debug:
       verbosity: detailed
\ Add the `debug` exporter to the logs pipeline under the `service` section: 
service:
     pipelines:
       logs:
         receivers: [otlp]
         processors: [resourcedetection, memory_limiter, batch]
         exporters: [awscloudwatchlogs, debug]
2. **Apply the Configuration**\ Restart the OpenTelemetry Collector container to apply the new pipeline configuration: 
$ sudo systemctl status otelcol.service
3. To check the logs 
$ journalctl -u otelcol.service
Expected output: ```shellscript Jul 05 19:33:45 ip-172-31-25-81 systemd[1]: Started otelcol.service - OpenTelemetry Collector (Bluerock). Jul 05 19:33:45 ip-172-31-25-81 run-otelcol.sh[2628]: 2026/07/05 19:33:45 ADOT Collector version: v0.44.0 Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026/07/05 19:33:46 attn: users of the `datadog`, `logzio`, `sapm`, `signalfx` exporter components. please refer to https://github.com/> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.311Z info service@v0.130.0/service.go:197 Setting up own telemetry... {"resource": {"se> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.318Z info builders/builders.go:26 Development component. May change in the future. {"re> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.325Z info builders/builders.go:26 Unmaintained component. Actively looking for contributors. C> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.325Z debug awsutil@v0.130.0/conn.go:26 Using proxy address: {"resource": {"service.ins> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.326Z debug awsutil@v0.130.0/conn.go:98 Fetch region from commandline/config file {"reso> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug builders/builders.go:24 Beta component. May change in the future. {"resource> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug builders/builders.go:24 Stable component. {"resource": {"service.instance.id> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug Logger core does not support injecting component attributes {"resource": {"service.> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug otlpreceiver@v0.130.0/otlp.go:58 created signal-agnostic logger {"resource":> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug builders/builders.go:24 Beta component. May change in the future. {"resource> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.329Z debug builders/builders.go:24 Stable component. {"resource": {"service.instance.id> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.331Z info service@v0.130.0/service.go:257 Starting aws-otel-collector... {"resource": {> Jul 05 19:33:46 ip-172-31-25-81 run-otelcol.sh[2628]: 2026-07-05T19:33:46.331Z info extensions/extensions.go:41 Starting extensions... {"resource": {"service.ins> ``` ### Sandbox Telemetry Event Profiles All acoustic telemetry events emitted by the `brace-shim` (`io.containerd.bluerock.v2`) or the standalone CLI sandbox are passed over the Unix domain socket (`/run/bluerock/sensor.sock`) to the host daemon for immediate policy evaluation and logging. #### Event Catalog Summary
Event NameTrigger Syscall(s)Trigger ConditionMode Support
brace_execexecve, execveatAny execution of a binary file inside the container sandbox.CLI, Shim
brace_mmap_execmmap, execve, execveatmmap called with PROT_EXEC or execution targeting an in-memory memfd.CLI, Shim
brace_file_openopen, openatAny file open operation (read-only opens can be filtered out via policy).CLI, Shim
brace_socketsocketSocket initialization inside the sandbox boundary.CLI, Shim
brace_connectconnectNetwork egress or internal Unix socket connection attempts.CLI, Shim
brace_deleteunlink, unlinkat, rmdirFile or directory deletions inside the container sandbox.CLI, Shim
brace_suspicious_syscallunshare, ptraceBlockable container-escape or process-injection attempts.CLI, Shim
brace_process_terminateexit, exit_groupVoluntary termination of a sandboxed process.CLI, Shim
*** #### The Common Event Envelope To prevent redundant indexing, all telemetry events (except `sensor_startup` and `brace_process_terminate`) share an identical foundational metadata wrapper created by `runtime/common/mod.rs`. Event-specific payloads are merged directly at the top level alongside these parameters: ```json { "meta": { "name": "", "type": "event", "domain": "sensor", "origin": "brace", "source_event_id": 0000xxx }, "context": { "process": { "comm": "", "file_path": "", "pid": 1234 }, "cwd": "" } // Event-specific data block merges here } ``` **Common Wrapper Field Dictionary** * `meta.source_event_id` *(integer)*: The seccomp notify request identifier (`request ID % i64::MAX`). * `context.process.comm` *(string)*: Short executable name extracted directly from `/proc//comm`. * `context.process.file_path` *(string)*: Absolute host-resolved filesystem path extracted from `/proc//exe`. * `context.process.pid` *(integer)*: Process ID executing the intercepted syscall. * `context.cwd` *(string)*: Current working directory extracted from `/proc//cwd`. #### **brace\_process\_exec** Fired on container process spawning loops. Policy rules can explicitly flag `exec.remediate = true` to drop execution. * Payload Fields: * `file_path` *(string)*: Target absolute path of the binary being executed inside the namespace. * `args` *(array of strings)*: The `argv` parameter array (capped at a maximum of 32 entries). * `env` *(array of strings)*: The `envp` context array expressed as standard `KEY=VALUE` pairs (capped at 32 entries). ```json { "body": { "args": [ "rm", "-rf", "/tmp/xxxxxxxxxxxxxxxxxxxx" ], "context": { "parent_process": { "comm": "python3.12", "pid": 00000 }, "process": { "comm": "python3.12", "cwd": "/home/xxxxxx", "effective_capability": 9216, "egid": 0000, "euid": 0000, "file_path": "/usr/bin/python3.12", "gid": 0000, "permitted_capability": 9216, "pid": 00000, "sys_daemon": false, "uid": 0000 } }, "env": [ "SHELL=/bin/bash", "PWD=/home/xxxxxx", "LOGNAME=xxxxxx", "XDG_SESSION_TYPE=tty", "HOME=/home/xxxxxx", "LANG=C.UTF-8", "LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.crdownload=00;90:*.dpkg-dist=00;90:*.dpkg-new=00;90:*.dpkg-old=00;90:*.dpkg-tmp=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:*.swp=00;90:*.tmp=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90:", "SSH_USER_AUTH=/tmp/xxxxxxxxxxxxxxxxxxxxxxxxxxxx", "SSH_CONNECTION=xx.xxx.xxx.xxx xxxxx xx.xxx.xxx.xxx xx", "LESSCLOSE=/usr/bin/lesspipe %s %s", "XDG_SESSION_CLASS=user", "TERM=xterm-256color", "LESSOPEN=| /usr/bin/lesspipe %s", "USER=xxxxxx", "SHLVL=2", "XDG_SESSION_ID=1", "XDG_RUNTIME_DIR=/run/user/0000", "SSH_CLIENT=xx.xxx.xxx.xxx xxxxx xx", "XDG_DATA_DIRS=/usr/local/share:/usr/share:/var/lib/snapd/desktop", "PATH=/home/xxxxxx/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/0000/bus", "SSH_TTY=/dev/pts/0", "_=/usr/bin/python3.12" ], "file_path": "/usr/bin/rm" }, "severity_number": 9, "severity_text": "INFO", "attributes": { "domain": "gyro", "event_name": "brace_process_exec", "hostid": "ip-xxx-xx-xx-xxx", "origin": "brace", "sensor_id": 0000, "source_event_id": 0000000000000000000, "type": "event" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` #### **brace\_mmap\_exec** Tracks executable mappings. Used specifically to catch JIT engines, dynamic shared object loads, or in-memory fileless executions targeting memory file descriptors. * Payload Fields: * `file_path` *(string)*: Path mapped from the file descriptor (e.g., `/memfd:payload` or `/usr/lib/libc.so.6`). Returns an empty string for anonymous space mappings. * `is_memfd` *(boolean)*: Evaluates to `true` if `file_path` initiates with a `/memfd:` prefix, signifying fileless injection. * `prot` *(integer)*: Protection mask integer passed to `mmap` (defaults to `0` for pure `memfd` execution traps). * `fd` *(integer)*: The integer file descriptor index being mapped (`-1` indicates an anonymous segment). ```json { "body": { "source_event": { "context": { "parent_process": { "comm": "python3.12", "pid": 00000 }, "process": { "comm": "python3.12", "cwd": "/home/xxxxxx", "effective_capability": 9216, "egid": 0000, "euid": 0000, "file_path": "/usr/bin/python3.12", "gid": 0000, "permitted_capability": 9216, "pid": 00000, "sys_daemon": false, "uid": 0000 } }, "fd": 3, "file_path": "/memfd: (deleted)", "is_memfd": true, "meta": { "domain": "sensor", "name": "brace_mmap_exec", "origin": "brace", "sensor_id": 0000, "source_event_id": 0000000000000000000, "type": "event" }, "prot": 0 } }, "severity_number": 13, "severity_text": "WARN", "attributes": { "description": "brace mmap exec: process '/usr/bin/python3.12' (00000) executing from memfd '/memfd: (deleted)'", "domain": "gyro", "event_name": "brace_mmap_exec_violation", "hostid": "ip-xxx-xx-xx-xxx", "origin": "acoustic BRace sensor", "remediation_kind": "log", "sensor_id": 0000, "source_event_id": 0000000000000000000, "type": "log" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` #### **brace\_file\_open** Tracks interaction with the filesystem. Read-only noise can be filtered early by toggling `open.allow_read_only = true` inside the active policy. * Payload Fields: * `file_path` *(string)*: Absolute path of the targeted resource resolved inside the process namespace. * `flags` *(integer)*: Raw `O_*` access mode bitmask flags passed directly to the kernel layer. * `is_writeable` *(boolean)*: Evaluates to `true` if `flags & O_ACCMODE` resolves to write-access formats (e.g., `O_WRONLY`, `O_RDWR`). * `is_link` / `is_dir` / `is_fifo` / `is_socket` *(boolean, nullable)*: Evaluates file node types from a fallback `stat` evaluation. Returns `null` if the underlying node check fails. ```json { "body": { "context": { "parent_process": { "comm": "bash", "pid": 00000 }, "process": { "comm": "python3.12", "cwd": "/home/xxxxxx", "effective_capability": 9216, "egid": 0000, "euid": 0000, "file_path": "/usr/bin/python3.12", "gid": 0000, "permitted_capability": 9216, "pid": 00000, "sys_daemon": false, "uid": 0000 } }, "file_path": "/tmp/xxxxxxxxxxxxxxxxx/f", "flags": 524865, "is_dir": "null", "is_fifo": "null", "is_link": "null", "is_socket": "null", "is_writeable": true }, "severity_number": 9, "severity_text": "INFO", "attributes": { "domain": "gyro", "event_name": "brace_file_open", "hostid": "ip-xxx-xx-xx-xxx", "origin": "brace", "sensor_id": 0000, "source_event_id": 0000000000000000000, "type": "event" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` #### **brace\_socket** Fired when any low-level socket interface initialization occurs inside the sandbox parameters. * Payload Fields: * `domain` *(integer)*: The numeric mapping for the `AF_*` address family (e.g., `1` = UNIX, `2` = INET, `10` = INET6, `16` = NETLINK). * `socket_type` *(integer)*: The type constraints (`1` = SOCK\_STREAM, `2` = SOCK\_DGRAM, `3` = SOCK\_RAW). * `protocol` *(integer)*: Target protocol assignments (`0` handles standard domain/type automatic assignment). ```json { "body": { "context": { "parent_process": { "comm": "bash", "pid": 00000 }, "process": { "comm": "python3.12", "cwd": "/home/xxxxxx", "effective_capability": 9216, "egid": 0000, "euid": 0000, "file_path": "/usr/bin/python3.12", "gid": 0000, "permitted_capability": 9216, "pid": 00000, "sys_daemon": false, "uid": 0000 } }, "domain": 10, "protocol": 0, "socket_type": 524289 }, "severity_number": 9, "severity_text": "INFO", "attributes": { "domain": "gyro", "event_name": "brace_socket", "hostid": "ip-xxx-xx-xx-xxx", "origin": "brace", "sensor_id": 0000, "source_event_id": 0000000000000000000, "type": "event" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` #### **brace\_connect** Intercepts stream destination establishment. The raw `sockaddr` buffer is decoded directly from the container memory tracking maps. * Payload Fields: * `sockfd` *(integer)*: The host file descriptor index mapped to the socket being connected. * `addr_family` *(integer)*: Extracted `sockaddr` family enum (`1` = Unix pathing, `2` = IPv4, `10` = IPv6). * `addr` *(string)*: Formatted target destination address (e.g., `1.2.3.4:443`, `[::1]:80`, or `unix:/run/bluerock/sensor.sock`). ```json { "body": { "addr": "xxx.x.x.x:xx", "addr_family": 2, "context": { "parent_process": { "comm": "bash", "pid": 00000 }, "process": { "comm": "python3.12", "cwd": "/home/xxxxxx", "effective_capability": 9216, "egid": 0000, "euid": 0000, "file_path": "/usr/bin/python3.12", "gid": 0000, "permitted_capability": 9216, "pid": 00000, "sys_daemon": false, "uid": 0000 } }, "sockfd": 3 }, "severity_number": 9, "severity_text": "INFO", "attributes": { "domain": "gyro", "event_name": "brace_connect", "hostid": "ip-xxx-xx-xx-xxx", "origin": "brace", "sensor_id": 0000, "source_event_id": 0000000000000000000, "type": "event" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` #### **brace\_delete** Tracks file removals. This event acts strictly in observation mode and cannot be mathematically blocked at the seccomp layer. * Payload Fields: * `file_path` *(string)*: Target absolute path being unlinked or removed. * `is_dir` *(boolean)*: Resolves to `true` if initiated via an `rmdir` syscall or an `unlinkat` execution carrying the `AT_REMOVEDIR` parameter flag. ```json { "body": { "context": { "parent_process": { "comm": "bash", "pid": 00000 }, "process": { "comm": "python3.12", "cwd": "/home/xxxxxx", "effective_capability": 9216, "egid": 0000, "euid": 0000, "file_path": "/usr/bin/python3.12", "gid": 0000, "permitted_capability": 9216, "pid": 00000, "sys_daemon": false, "uid": 0000 } }, "file_path": "/tmp/xxxxxxxxxxxxxxxxxxxxxxxxx", "is_dir": false }, "severity_number": 9, "severity_text": "INFO", "attributes": { "domain": "gyro", "event_name": "brace_delete", "hostid": "ip-xxx-xx-xx-xxx", "origin": "brace", "sensor_id": 0000, "source_event_id": 0000000000000000000, "type": "event" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` #### **brace\_suspicious\_syscall** Triggers immediately when operations linked to container escape vectors or low-level process memory modifications are caught. Controlled directly via `suspicious_syscalls.allow_unshare` and `suspicious_syscalls.allow_ptrace`. * Payload Fields: * `syscall` *(string)*: The string identification of the trapped call (explicitly restricts `"unshare"` or `"ptrace"`). ```json { "body": { "source_event": { "context": { "parent_process": { "comm": "bash", "pid": 00000 }, "process": { "comm": "python3.12", "cwd": "/home/ubuntu", "effective_capability": 0000, "egid": 1000, "euid": 1000, "file_path": "/usr/bin/python3.12", "gid": 1000, "permitted_capability": 0000, "pid": 00000, "sys_daemon": false, "uid": 0000 } }, "meta": { "domain": "sensor", "name": "brace_suspicious_syscall", "origin": "brace", "sensor_id": 1111, "source_event_id": 00000000000000, "type": "event" }, "syscall": "unshare" } }, "severity_number": 13, "severity_text": "WARN", "attributes": { "description": "brace suspicious syscall: process '/usr/bin/python3.12' (23724) attempted 'unshare'", "domain": "gyro", "event_name": "brace_suspicious_syscall_violation", "hostid": "", "origin": "acoustic BRace sensor", "remediation_kind": "log", "sensor_id": 0000, "source_event_id": 000000000000000, "type": "log" }, "scope": { "name": "bluerockd" }, "resource": { "service.name": "bluerock" } } ``` #### **brace\_process\_terminate** Fired on standard clean process termination flows. Because it intercepts the process before it completes its cleanup via seccomp sync points, process names remain entirely readable. {% hint style="info" icon="notes-sticky" %} **Note:** This event purposefully omits the common `context` object block. Its flat structure directly mimics the native kernel-level `process_terminate` schema, allowing uniform parsing logic to ingest exits identically, regardless of whether they originate from the host kernel sensor or the container runtime shim. {% endhint %} * Payload Fields: * `pid` *(integer)*: The process identifier exiting the sandbox environment. * `comm` *(string)*: The short process text identifier captured from `/proc//comm`. * `exit_code` *(integer)*: Numeric status return value passed to the `exit()` / `exit_group()` routine. * `exit_signal` *(integer)*: Always returns `0`. Workloads explicitly terminated by unhandled kernel signals (e.g., `SIGKILL`) bypass seccomp and will not record a termination metric here. ```json { "meta": { "name": "brace_process_terminate", "type": "event", "domain": "sensor", "origin": "brace", "source_event_id": 0000111 }, "pid": 1234, "comm": "python3", "exit_code": 0, "exit_signal": 0 } ``` #### Running Hardened Containers via Native containerd CLI If your environment interacts directly with the lower-level containerd engine layer bypassing the Docker engine wrapper, utilize the native `ctr` tool formatting: ```bash sudo ctr run --runtime io.containerd.bluerock.v2 docker.io/library/ubuntu:22.04 my-container bash ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bluerock.io/bluerock-sandbox/bluerock-sandbox-observability.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.