25c - 日志管理与审计

┌─────────────────────────────────────────────────────────┐
│                    日志消费层                              │
│   Grafana 日志面板 / Kibana / 告警规则 / 合规报告         │
├─────────────────────────────────────────────────────────┤
│                    日志存储层                              │
│   Grafana Loki（标签索引）  或  Elasticsearch（全文索引）  │
├─────────────────────────────────────────────────────────┤
│                    日志采集层                              │
│   Promtail / Alloy        或  Logstash / Filebeat        │
├─────────────────────────────────────────────────────────┤
│                    日志生成层                              │
│   Docker 容器日志    应用结构化日志    Agent 审计日志       │
│   (stdout/stderr)   (JSON 格式)      (操作轨迹记录)      │
├─────────────────────────────────────────────────────────┤
│                    日志来源                                │
│   OpenClaw Gateway   Agent Workers   LLM API 调用        │
│   工具执行器         用户会话         系统事件             │
└─────────────────────────────────────────────────────────┘

# docker-compose.logging.yml — 日志栈
# 与主服务和监控栈配合使用：
# docker compose -f docker-compose.yml \
#   -f docker-compose.monitoring.yml \
#   -f docker-compose.logging.yml up -d
 
version: '3.8'
 
services:
  # ============================================
  # Loki — 日志存储与查询引擎
  # ============================================
  loki:
    image: grafana/loki:3.4.2
    container_name: openclaw-loki
    restart: unless-stopped
    user: "10001:10001"
    ports:
      - "127.0.0.1:3100:3100"
    volumes:
      - ./logging/loki/loki-config.yml:/etc/loki/local-config.yaml:ro
      - loki_data:/loki
    command: -config.file=/etc/loki/local-config.yaml
    networks:
      - openclaw-net
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3100/ready || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 3
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
 
  # ============================================
  # Promtail — 日志采集 Agent
  # ============================================
  promtail:
    image: grafana/promtail:3.4.2
    container_name: openclaw-promtail
    restart: unless-stopped
    volumes:
      - ./logging/promtail/promtail-config.yml:/etc/promtail/config.yml:ro
      - /var/log:/var/log:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command: -config.file=/etc/promtail/config.yml
    networks:
      - openclaw-net
    depends_on:
      loki:
        condition: service_healthy
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
 
volumes:
  loki_data:

# logging/loki/loki-config.yml
auth_enabled: false
 
server:
  http_listen_port: 3100
  grpc_listen_port: 9096
  log_level: warn
 
common:
  instance_addr: 127.0.0.1
  path_prefix: /loki
  storage:
    filesystem:
      chunks_directory: /loki/chunks
      rules_directory: /loki/rules
  replication_factor: 1
  ring:
    kvstore:
      store: inmemory
 
schema_config:
  configs:
    - from: "2024-01-01"
      store: tsdb
      object_store: filesystem
      schema: v13
      index:
        prefix: index_
        period: 24h
 
storage_config:
  filesystem:
    directory: /loki/chunks
 
limits_config:
  retention_period: 30d              # 日志保留 30 天
  max_query_length: 721h             # 最大查询范围 30 天
  max_query_parallelism: 4
  max_entries_limit_per_query: 10000
  ingestion_rate_mb: 10              # 每租户摄入速率限制
  ingestion_burst_size_mb: 20
  per_stream_rate_limit: 5MB         # 每流速率限制
  per_stream_rate_limit_burst: 15MB
 
compactor:
  working_directory: /loki/compactor
  compaction_interval: 10m
  retention_enabled: true            # 启用自动清理过期日志
  retention_delete_delay: 2h
  retention_delete_worker_count: 150
 
query_range:
  results_cache:
    cache:
      embedded_cache:
        enabled: true
        max_size_mb: 100
 
analytics:
  reporting_enabled: false

# logging/promtail/promtail-config.yml
server:
  http_listen_port: 9080
  grpc_listen_port: 0
 
positions:
  filename: /tmp/positions.yaml
 
clients:
  - url: http://loki:3100/loki/api/v1/push
    tenant_id: openclaw
    batchwait: 1s
    batchsize: 1048576    # 1 MB
 
scrape_configs:
  # ============================================
  # Docker 容器日志采集
  # ============================================
  - job_name: docker
    docker_sd_configs:
      - host: unix:///var/run/docker.sock
        refresh_interval: 5s
        filters:
          - name: label
            values: ["logging=enabled"]
    relabel_configs:
      # 提取容器名作为标签
      - source_labels: ['__meta_docker_container_name']
        regex: '/(.*)'
        target_label: 'container'
      # 提取 compose 服务名
      - source_labels: ['__meta_docker_container_label_com_docker_compose_service']
        target_label: 'service'
      # 提取 compose 项目名
      - source_labels: ['__meta_docker_container_label_com_docker_compose_project']
        target_label: 'project'
      # 提取日志流（stdout/stderr）
      - source_labels: ['__meta_docker_container_log_stream']
        target_label: 'stream'
    pipeline_stages:
      # 尝试解析 JSON 格式日志
      - json:
          expressions:
            level: level
            msg: msg
            timestamp: timestamp
            component: component
            agent_id: agent_id
            session_id: session_id
            task_id: task_id
      # 设置日志级别标签
      - labels:
          level:
          component:
      # 设置时间戳
      - timestamp:
          source: timestamp
          format: RFC3339Nano
          fallback_formats:
            - "2006-01-02T15:04:05Z07:00"
            - UnixMs
      # 过滤健康检查噪音日志
      - match:
          selector: '{service="openclaw-gateway"}'
          stages:
            - regex:
                expression: '.*GET /health.*'
            - drop:
                expression: '.*GET /health.*'
                drop_counter_reason: health_check_noise
 
  # ============================================
  # OpenClaw 审计日志文件采集
  # ============================================
  - job_name: openclaw-audit
    static_configs:
      - targets:
          - localhost
        labels:
          job: openclaw-audit
          log_type: audit
          __path__: /var/log/openclaw/audit/*.jsonl
    pipeline_stages:
      - json:
          expressions:
            level: level
            event_type: event_type
            agent_id: agent_id
            user_id: user_id
            action: action
            timestamp: timestamp
      - labels:
          event_type:
          agent_id:
          action:
      - timestamp:
          source: timestamp
          format: RFC3339Nano
 
  # ============================================
  # 系统日志采集
  # ============================================
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: syslog
          __path__: /var/log/syslog
    pipeline_stages:
      - regex:
          expression: '^(?P<timestamp>\w+\s+\d+\s+\d+:\d+:\d+)\s+(?P<hostname>\S+)\s+(?P<app>\S+?)(\[(?P<pid>\d+)\])?:\s+(?P<message>.*)$'
      - labels:
          app:

# monitoring/grafana/provisioning/datasources/loki.yml
apiVersion: 1
 
datasources:
  - name: Loki
    type: loki
    access: proxy
    url: http://loki:3100
    isDefault: false
    editable: false
    jsonData:
      maxLines: 1000
      derivedFields:
        # 从日志中提取 trace_id，关联到 Tempo（如果部署了）
        - datasourceUid: tempo
          matcherRegex: '"trace_id":"(\w+)"'
          name: TraceID
          url: '$${__value.raw}'

openclaw-deploy/
├── docker-compose.yml                    # 主服务
├── docker-compose.monitoring.yml         # 监控栈（25b）
├── docker-compose.logging.yml            # 日志栈（本节）
├── logging/
│   ├── loki/
│   │   └── loki-config.yml               # Loki 主配置
│   └── promtail/
│       └── promtail-config.yml           # Promtail 采集配置
├── monitoring/
│   └── grafana/
│       └── provisioning/
│           └── datasources/
│               ├── prometheus.yml         # Prometheus 数据源
│               └── loki.yml              # Loki 数据源（新增）
└── .env

# 创建目录
mkdir -p logging/{loki,promtail}
 
# 为 Docker 容器添加日志采集标签
# 在 docker-compose.yml 中为需要采集日志的服务添加：
# labels:
#   logging: "enabled"
 
# 启动全栈
docker compose -f docker-compose.yml \
  -f docker-compose.monitoring.yml \
  -f docker-compose.logging.yml up -d
 
# 验证 Loki 就绪
curl -s http://127.0.0.1:3100/ready
# 预期输出: ready
 
# 验证 Promtail 目标
curl -s http://127.0.0.1:9080/targets | head -20
 
# 在 Grafana 中验证（http://127.0.0.1:3000）
# 进入 Explore → 选择 Loki 数据源 → 输入 {service="openclaw-gateway"}

{
  "timestamp": "2026-01-15T08:30:45.123Z",
  "level": "info",
  "component": "agent-worker",
  "msg": "Tool execution completed",
  "agent_id": "agent-research-01",
  "session_id": "sess_abc123def456",
  "task_id": "task_789",
  "trace_id": "trace_xyz",
  "tool_name": "web_search",
  "tool_input_hash": "sha256:a1b2c3...",
  "tool_duration_ms": 1250,
  "tool_status": "success",
  "token_count": 0,
  "cost_usd": 0.0,
  "metadata": {
    "search_query": "OpenClaw production deployment",
    "results_count": 5
  }
}

{标签选择器} |= "文本过滤" | json | line_format "格式化"

# 查看 OpenClaw Gateway 所有日志
{service="openclaw-gateway"}

# 查看所有错误日志
{service="openclaw-gateway"} |= "error" 

# 查看特定 Agent 的日志
{service="openclaw-gateway"} | json | agent_id="agent-research-01"

# 排除健康检查日志
{service="openclaw-gateway"} != "/health" != "/ready"

# 查看特定会话的所有操作
{job="openclaw-audit"} | json | session_id="sess_abc123def456"

# 查看所有工具调用失败
{service="openclaw-gateway"} | json | tool_status="failure"

# 查看特定 Agent 的 LLM 调用
{service="openclaw-gateway"} 
  | json 
  | agent_id="agent-research-01" 
  | component="llm-client"

# 查看执行时间超过 30 秒的工具调用
{service="openclaw-gateway"} 
  | json 
  | tool_duration_ms > 30000

# 过去 1 小时各 Agent 的错误数量
sum by (agent_id) (
  count_over_time(
    {service="openclaw-gateway"} | json | level="error" [1h]
  )
)

# 过去 24 小时各工具的调用次数
sum by (tool_name) (
  count_over_time(
    {job="openclaw-audit"} | json | event_type="tool_call" [24h]
  )
)

# 每 5 分钟的日志量趋势
sum(rate({service="openclaw-gateway"}[5m])) by (level)

# 过去 1 小时 P95 工具执行延迟
quantile_over_time(0.95,
  {service="openclaw-gateway"} 
    | json 
    | unwrap tool_duration_ms [1h]
) by (tool_name)

# 每小时 Token 消耗趋势
sum(sum_over_time(
  {job="openclaw-audit"} 
    | json 
    | event_type="llm_call" 
    | unwrap token_count [1h]
)) by (model_name)

# 5 分钟内错误率超过阈值（用于 Grafana 告警）
sum(rate({service="openclaw-gateway"} | json | level="error" [5m]))
/
sum(rate({service="openclaw-gateway"} [5m]))
> 0.1

# 检测 Agent 死循环（同一 Agent 短时间内大量日志）
sum by (agent_id) (
  count_over_time(
    {service="openclaw-gateway"} | json [5m]
  )
) > 1000

你是一个 Grafana Loki 专家。请根据以下需求生成 LogQL 查询。

日志格式：JSON 结构化日志
可用标签：service, level, component, agent_id, session_id
可用 JSON 字段：msg, tool_name, tool_status, tool_duration_ms, 
  model_provider, model_name, token_count, cost_usd, error_code

需求：[描述你想查询的内容]

请生成：
1. LogQL 查询语句
2. 查询说明（中文）
3. 如果是聚合查询，建议的 Grafana 面板类型（时序图/柱状图/表格/统计值）

{
  "$schema": "openclaw-audit-log-v1",
  "timestamp": "2026-01-15T08:30:45.123456Z",
  "event_id": "evt_01JQXYZ123456789",
  "event_type": "tool.invoke",
  "event_category": "tool_call",
  "severity": "info",
  
  "actor": {
    "type": "agent",
    "id": "agent-research-01",
    "name": "Research Assistant",
    "session_id": "sess_abc123def456",
    "parent_agent_id": null
  },
  
  "initiator": {
    "type": "user",
    "id": "user_john",
    "ip": "192.168.1.100",
    "user_agent": "Mozilla/5.0..."
  },
  
  "action": {
    "type": "tool_invoke",
    "tool_name": "web_search",
    "tool_version": "1.2.0",
    "input_summary": "Search: OpenClaw deployment best practices",
    "input_hash": "sha256:a1b2c3d4e5f6...",
    "output_summary": "5 results returned",
    "output_hash": "sha256:f6e5d4c3b2a1...",
    "duration_ms": 1250,
    "status": "success"
  },
  
  "context": {
    "task_id": "task_789",
    "task_description": "Research production deployment",
    "conversation_turn": 5,
    "model_provider": "anthropic",
    "model_name": "claude-sonnet-4-20250514",
    "token_input": 1500,
    "token_output": 800,
    "estimated_cost_usd": 0.012
  },
  
  "resource": {
    "type": "external_api",
    "id": "google_search_api",
    "permissions_used": ["web:read"]
  },
  
  "metadata": {
    "openclaw_version": "0.5.2",
    "node_id": "node-01",
    "environment": "production"
  }
}

#!/usr/bin/env python3
"""
openclaw_audit_logger.py — OpenClaw 审计日志中间件
将 Agent 操作事件写入 JSONL 审计日志文件，由 Promtail 采集到 Loki
"""
 
import json
import os
import time
import uuid
import hashlib
from datetime import datetime, timezone
from pathlib import Path
 
# 审计日志目录
AUDIT_LOG_DIR = Path(os.getenv("AUDIT_LOG_DIR", "/var/log/openclaw/audit"))
AUDIT_LOG_DIR.mkdir(parents=True, exist_ok=True)
 
# 当前日志文件（按天轮转）
def get_audit_log_path():
    date_str = datetime.now(timezone.utc).strftime("%Y-%m-%d")
    return AUDIT_LOG_DIR / f"audit-{date_str}.jsonl"
 
def generate_event_id():
    """生成唯一事件 ID"""
    return f"evt_{uuid.uuid4().hex[:20]}"
 
def hash_content(content: str) -> str:
    """对内容生成 SHA256 摘要（不存储原文，保护隐私）"""
    return f"sha256:{hashlib.sha256(content.encode()).hexdigest()[:16]}"
 
def write_audit_event(event: dict):
    """写入审计事件到 JSONL 文件（追加模式，不可覆盖）"""
    log_path = get_audit_log_path()
    event["timestamp"] = datetime.now(timezone.utc).isoformat()
    event["event_id"] = event.get("event_id", generate_event_id())
    
    with open(log_path, "a") as f:
        f.write(json.dumps(event, ensure_ascii=False) + "\n")
 
# ============================================
# 审计事件工厂函数
# ============================================
 
def audit_tool_call(agent_id, session_id, tool_name, 
                     tool_input, tool_output, duration_ms, 
                     status, user_id=None):
    """记录工具调用审计事件"""
    write_audit_event({
        "event_type": "tool.invoke",
        "event_category": "tool_call",
        "severity": "info" if status == "success" else "error",
        "actor": {
            "type": "agent",
            "id": agent_id,
            "session_id": session_id
        },
        "initiator": {
            "type": "user",
            "id": user_id or "system"
        },
        "action": {
            "type": "tool_invoke",
            "tool_name": tool_name,
            "input_hash": hash_content(str(tool_input)),
            "output_hash": hash_content(str(tool_output)),
            "duration_ms": duration_ms,
            "status": status
        }
    })
 
def audit_llm_call(agent_id, session_id, provider, model,
                    token_input, token_output, cost_usd,
                    duration_ms, status):
    """记录 LLM 调用审计事件"""
    write_audit_event({
        "event_type": "llm.request",
        "event_category": "llm_interaction",
        "severity": "info" if status == "success" else "error",
        "actor": {
            "type": "agent",
            "id": agent_id,
            "session_id": session_id
        },
        "context": {
            "model_provider": provider,
            "model_name": model,
            "token_input": token_input,
            "token_output": token_output,
            "estimated_cost_usd": cost_usd,
            "duration_ms": duration_ms
        },
        "action": {
            "type": "llm_request",
            "status": status
        }
    })
 
def audit_user_action(user_id, action_type, details, ip=None):
    """记录用户操作审计事件"""
    write_audit_event({
        "event_type": f"user.{action_type}",
        "event_category": "user_action",
        "severity": "info",
        "actor": {
            "type": "user",
            "id": user_id,
            "ip": ip
        },
        "action": {
            "type": action_type,
            "details": details
        }
    })
 
# ============================================
# 使用示例
# ============================================
if __name__ == "__main__":
    # 记录工具调用
    audit_tool_call(
        agent_id="agent-research-01",
        session_id="sess_abc123",
        tool_name="web_search",
        tool_input="OpenClaw deployment guide",
        tool_output="5 results found",
        duration_ms=1250,
        status="success",
        user_id="user_john"
    )
    
    # 记录 LLM 调用
    audit_llm_call(
        agent_id="agent-research-01",
        session_id="sess_abc123",
        provider="anthropic",
        model="claude-sonnet-4-20250514",
        token_input=1500,
        token_output=800,
        cost_usd=0.012,
        duration_ms=3200,
        status="success"
    )
    
    print(f"审计日志已写入: {get_audit_log_path()}")

# 在 loki-config.yml 的 limits_config 中配置
limits_config:
  retention_period: 30d    # 默认保留 30 天
 
# 按标签设置不同保留期
# Loki 3.x 支持按流的保留策略
overrides:
  # 审计日志保留 365 天
  openclaw-audit:
    retention_period: 365d
  
  # 调试日志仅保留 3 天
  debug:
    retention_period: 72h

#!/bin/bash
# scripts/archive-audit-logs.sh
# 将超过 30 天的审计日志归档到 S3/MinIO
 
AUDIT_DIR="/var/log/openclaw/audit"
S3_BUCKET="s3://openclaw-audit-archive"
ARCHIVE_AFTER_DAYS=30
 
# 查找超过 30 天的审计日志文件
find "$AUDIT_DIR" -name "audit-*.jsonl" -mtime +$ARCHIVE_AFTER_DAYS | while read file; do
    filename=$(basename "$file")
    date_part=$(echo "$filename" | grep -oP '\d{4}-\d{2}-\d{2}')
    
    # 压缩并上传到 S3
    gzip -c "$file" > "/tmp/${filename}.gz"
    
    # 上传到按年月组织的目录
    year_month=$(echo "$date_part" | cut -d'-' -f1,2)
    aws s3 cp "/tmp/${filename}.gz" \
        "${S3_BUCKET}/${year_month}/${filename}.gz" \
        --storage-class GLACIER_IR
    
    # 验证上传成功后删除本地文件
    if [ $? -eq 0 ]; then
        rm "$file" "/tmp/${filename}.gz"
        echo "[$(date)] Archived: $filename → ${S3_BUCKET}/${year_month}/"
    fi
done

# 每天凌晨 3 点执行归档
0 3 * * * /opt/openclaw/scripts/archive-audit-logs.sh >> /var/log/openclaw/archive.log 2>&1

你是一个合规与安全专家。请为我的 AI Agent 平台生成日志合规策略。

平台信息：
- 平台类型：[OpenClaw / 自建 Agent 平台]
- 部署区域：[中国 / 欧盟 / 美国 / 全球]
- 适用合规框架：[GDPR / SOC 2 / HIPAA / EU AI Act / 等保 2.0]
- 数据类型：[是否处理 PII / 医疗数据 / 金融数据]
- 当前日志存储：[Loki / ELK / 云服务]

请生成：
1. 各类日志的保留策略表（类型、保留期、存储层、合规依据）
2. PII 脱敏规则（哪些字段需要脱敏、脱敏方法）
3. 审计日志不可篡改性保障方案
4. 日志访问控制策略（谁可以查看什么级别的日志）
5. 定期审查清单（频率、检查项）

# docker-compose.elk.yml — ELK 栈（可选）
# 仅在需要全文搜索时部署
# docker compose -f docker-compose.yml \
#   -f docker-compose.monitoring.yml \
#   -f docker-compose.logging.yml \
#   -f docker-compose.elk.yml up -d
 
version: '3.8'
 
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.17.4
    container_name: openclaw-elasticsearch
    restart: unless-stopped
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=false
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - cluster.name=openclaw-logs
      - bootstrap.memory_lock=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - es_data:/usr/share/elasticsearch/data
    ports:
      - "127.0.0.1:9200:9200"
    networks:
      - openclaw-net
    healthcheck:
      test: ["CMD-SHELL", "curl -s -u elastic:${ELASTIC_PASSWORD} http://localhost:9200/_cluster/health | grep -q '\"status\":\"green\\|yellow\"'"]
      interval: 30s
      timeout: 10s
      retries: 5
 
  kibana:
    image: docker.elastic.co/kibana/kibana:8.17.4
    container_name: openclaw-kibana
    restart: unless-stopped
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
    ports:
      - "127.0.0.1:5601:5601"
    networks:
      - openclaw-net
    depends_on:
      elasticsearch:
        condition: service_healthy
 
  filebeat:
    image: docker.elastic.co/beats/filebeat:8.17.4
    container_name: openclaw-filebeat
    restart: unless-stopped
    user: root
    volumes:
      - ./elk/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/log/openclaw:/var/log/openclaw:ro
      - filebeat_data:/usr/share/filebeat/data
    networks:
      - openclaw-net
    depends_on:
      elasticsearch:
        condition: service_healthy
 
volumes:
  es_data:
  filebeat_data:

# elk/filebeat/filebeat.yml
filebeat.inputs:
  # 审计日志（JSON 格式）
  - type: log
    enabled: true
    paths:
      - /var/log/openclaw/audit/*.jsonl
    json.keys_under_root: true
    json.add_error_key: true
    fields:
      log_type: audit
    fields_under_root: true
 
  # Docker 容器日志
  - type: container
    paths:
      - /var/lib/docker/containers/*/*.log
    processors:
      - add_docker_metadata:
          host: "unix:///var/run/docker.sock"
 
output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  username: "elastic"
  password: "${ELASTIC_PASSWORD}"
  indices:
    - index: "openclaw-audit-%{+yyyy.MM}"
      when.equals:
        log_type: "audit"
    - index: "openclaw-logs-%{+yyyy.MM.dd}"
 
# 索引生命周期管理
setup.ilm:
  enabled: true
  rollover_alias: "openclaw-logs"
  pattern: "{now/d}-000001"
  policy_name: "openclaw-log-policy"

# 在 OpenClaw 部署目录下创建日志相关目录
cd /opt/openclaw
 
mkdir -p logging/{loki,promtail}
mkdir -p /var/log/openclaw/audit
 
# 设置审计日志目录权限（仅 root 和 openclaw 用户可写）
chown root:openclaw /var/log/openclaw/audit
chmod 770 /var/log/openclaw/audit

# 根据 VPS 资源调整
limits_config:
  retention_period: 90d              # 审计要求保留 90 天
  ingestion_rate_mb: 5               # 3 个 Agent 足够
  per_stream_rate_limit: 3MB

services:
  openclaw-gateway:
    image: openclaw/openclaw:latest
    labels:
      logging: "enabled"
    # ... 其他配置
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
        tag: "openclaw-gateway"

# 启动全栈
docker compose -f docker-compose.yml \
  -f docker-compose.monitoring.yml \
  -f docker-compose.logging.yml up -d
 
# 验证各组件
echo "=== Loki ===" && curl -s http://127.0.0.1:3100/ready
echo "=== Promtail targets ===" && curl -s http://127.0.0.1:9080/targets | python3 -m json.tool | head -30

# 查看所有 OpenClaw 日志
{service="openclaw-gateway"} | json

# 查看审计日志
{job="openclaw-audit"} | json

# 查看特定 Agent 的错误
{service="openclaw-gateway"} | json | agent_id="agent-research-01" | level="error"

# 告警：5 分钟内错误日志超过 20 条
count_over_time({service="openclaw-gateway"} | json | level="error" [5m]) > 20

# 告警：检测到权限拒绝事件
count_over_time({job="openclaw-audit"} | json | event_type="tool.permission_denied" [10m]) > 0

# 告警：单个 Agent 日志量异常（可能死循环）
sum by (agent_id) (count_over_time({service="openclaw-gateway"} | json [5m])) > 500