bhatti admin events

bhatti admin events server only

Query the structured event log.

Synopsis

sudo bhatti admin events
[--type <prefix>] [--user <name|id>] [--sandbox <name|id>]
[--since <range>] [--limit <n>] [--count]

Description

Returns rows from the audit/observability event log stored in the local database. Each event captures a moment in the system: sandbox lifecycle changes, thermal transitions, snapshot operations, image pulls, auth failures, proxy errors, daemon start/shutdown, and more.

Default output is one row per event with timestamp, type, user, sandbox, and a per-event-type summary line. JSON output includes the full meta object.

--type is a prefix match, so --type thermal matches thermal.pause, thermal.wake, thermal.snapshot, etc.

--since accepts:

Relative durations: 30s, 15m, 24h, 7d.
Absolute dates: 2026-04-01 (UTC midnight), 2026-04-01T12:00:00, full RFC3339.

--user and --sandbox accept either the name or the internal ID. Names are easier; IDs are stable across renames.

--count returns a number-only response — useful for alerting/scripting (if [[ $(bhatti admin events --type auth.failed --since 5m --count) -gt 10 ]]; then ...).

Examples

# Last 50 events of any kind
sudo bhatti admin events

# All thermal events in the last day
sudo bhatti admin events --type thermal --since 24h

# Auth failures in the last hour, count only
sudo bhatti admin events --type auth.failed --since 1h --count

# Everything Alice did this week
sudo bhatti admin events --user alice --since 7d

# Drill into one sandbox's history
sudo bhatti admin events --sandbox dev --since 24h

# JSON for piping into jq
sudo bhatti admin events --type sandbox.destroyed --since 7d --json \
  | jq '[.[] | .meta.lifetime_s] | add / length'   # avg sandbox lifetime

Options

Flag	Default	Description
`--type <prefix>`	—	Filter by event type. Prefix match (`thermal` matches `thermal.*`).
`--user <name\|id>`	—	Filter by user. Name or user ID.
`--sandbox <name\|id>`	—	Filter by sandbox. Name or ID.
`--since <range>`	—	Earliest event to include. Relative (`24h`, `7d`) or absolute (`2026-04-01`).
`--limit <int>`	`50`	Maximum number of events to return.
`--count`	`false`	Return only the count of matching events, not the rows.

See Global flags for --url, --token, --json, --timing, --data-dir.