nsc egress logs

Print egress filtering decisions for an instance.

egress logs prints the egress filtering decisions made for an instance — i.e. which outbound network requests were allowed or denied as your egress policy was evaluated. This is useful when debugging why a workload can't reach a destination it needs, or when confirming that a policy is blocking traffic as intended.

You can narrow the results to a time window with --after/--before, cap how many records are returned with --limit, and choose between a human-readable or machine-readable (json) output format.

Usage

nsc egress logs [instance-id] [--after <timestamp>] [--before <timestamp>] [--limit <count>] [-o <plain|json>]

Example

$ nsc create
Created instance "1lf2ol9ioulce"
 deadline: 2023-04-25T13:24:53Z
 
$ nsc egress logs 1lf2ol9ioulce

To only see decisions made in a specific time window, as structured JSON:

$ nsc egress logs 1lf2ol9ioulce --after 2024-01-15T10:30:00Z --before 2024-01-15T12:00:00Z -o json

Options

--after <timestamp>

Only show records after this timestamp, formatted as RFC3339 (e.g. 2024-01-15T10:30:00Z).

--before <timestamp>

Only show records before this timestamp, formatted as RFC3339 (e.g. 2024-01-15T12:00:00Z).

--limit <count>

Maximum number of egress records to return. Defaults to 20000.

--output, -o <plain|json>

Output format. Supported values are plain and json; json output prints one JSON object per line. Defaults to plain.