cloudtaser-cli target tail

Streams live events from the CloudTaser eBPF enforcement layer running on the target cluster. Events include blocked /proc/environ reads, /proc/mem access attempts, ptrace denials, and other enforcement actions.

This command connects to the eBPF daemonset pod on the selected node (or auto-selects a node if --node is not specified) and streams events to stdout with timestamp, event type, and namespace/pod formatting.

NOTE: this feature requires the eBPF gRPC event stream to be enabled in the CloudTaser configuration (ebpf.grpc.enabled=true in Helm values). If the gRPC stream is not available, the command will report an error.

Equivalent to 'karmor log' for the CloudTaser enforcement layer.

Usage

cloudtaser-cli target tail [flags]

Examples

# Stream all events from any node (auto-selects)
  cloudtaser-cli target tail

  # Stream events from a specific namespace
  cloudtaser-cli target tail --namespace production

  # Stream events from a specific node
  cloudtaser-cli target tail --node worker-1

  # Stream events as JSON for piping to jq
  cloudtaser-cli target tail --json

  # Show events since a specific time
  cloudtaser-cli target tail --since 5m

  # One-shot mode (no follow)
  cloudtaser-cli target tail --follow=false

Flags

Flag	Type	Default	Required	Description
--event-types	string	(empty)	no	comma-separated event types to filter (e.g. proc-environ,ptrace,proc-mem)
--follow	bool	true	no	continuously stream events (set --follow=false for one-shot)
--help, -h	bool	false	no	help for tail
--json	bool	false	no	output events as JSON lines
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	(empty)	no	filter events to this namespace (default: all namespaces)
--node	string	(empty)	no	stream events from a specific node (default: auto-select)
--operator-namespace	string	cloudtaser-system	no	namespace where CloudTaser components are installed
--since	string	(empty)	no	show events since duration (e.g. 5m, 1h) or RFC3339 timestamp
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands