Observability

OpenShell provides structured logging for every sandbox. Every network connection, process lifecycle event, filesystem policy decision, and configuration change is recorded so you can understand exactly what happened inside a sandbox.

This section covers:

• Sandbox Logging – How the two log formats work (standard tracing and OCSF structured events), where logs are stored, and how to read them.

• Accessing Logs – How to view logs through the CLI, TUI, and directly on the sandbox filesystem.

• OCSF JSON Export – How to enable full OCSF JSON output for integration with SIEMs, log aggregators, and compliance tools.