datagrok-tools 6.7.7 → 6.7.9

package/bin/commands/server-observe.js

@@ -0,0 +1,526 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.OBSERVE_USAGE = void 0;
+exports.fieldRows = fieldRows;
+exports.handleObserve = handleObserve;
+exports.parseDuration = parseDuration;
+exports.parseTime = parseTime;
+exports.setPath = setPath;
+var fs = _interopRequireWildcard(require("fs"));
+var _nodeDapi = require("../utils/node-dapi");
+var _serverOutput = require("../utils/server-output");
+var _walker = require("../utils/migrate/walker");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/// `grok s observe` (alias `grok s o`): problems, problem rules, logger settings, errors, the timeline and cloud logs,
+/// over `/problems`, `/admin/plugins/<key>/settings`, `/alerts/Test_rules`, `/log`, `/admin/metrics`, `/log/timeline`,
+/// `/log/cloud/*`, `/log/archive/*` and `/docker/containers`.
+
+const OBSERVE_USAGE = exports.OBSERVE_USAGE = `Usage: grok s observe <command> <verb> [args]      (alias: grok s o)
+
+  problems list [--status <s>] [--state <s>] [--alert-status <s>] [--kind <k>] [--key <k>] [--since 7d] [--limit 100]
+                                       Comma lists or all; --alert-status open lists the open alerts
+  problems get <id|kind:key>           One field per line, details by path
+  problems history <id|kind:key> [--limit 50]
+  problems status <id|kind:key> --data '{"status": "muted", "reason": "...", "until": "<ISO>"}' | --json body.json
+  problems ack <id|kind:key> --reason <text>
+  problems resolve <id|kind:key> --reason <text>
+  rules get                            The problem rules (Settings > Alerts), as JSON
+  rules put --json rules.json          Replace them; the server checks them first
+  rules test                           Evaluate the saved rules once, now
+  logger get [<path>]                  The logger settings, or one value (exportSettings.0.types)
+  logger set --set <path>=<json> ...   Change values; with --user <login> or --group <name|id>, that
+             [--for 30m | --until <ISO>] [--reason <text>]   entry of userGroupSettings (a new one starts from
+             [--remove]                                       All users), removed when it expires; --remove deletes it
+  logger history [--limit 20]          The log-settings-changed audit records, with each change's diff
+  errors top [--since 24h | --date "this week" | --from <ISO> [--to <ISO>]] [--by message|signature]
+             [--package <name>] [--user <login>] [--source <s>] [--limit 10]
+                                       Ranked by distinct users, so errors nobody saw (scheduler, health
+                                       probes) come last: narrow those with --source server
+  errors get <signature|problem> [--since 7d] [--limit 50]
+                                       Each occurrence of an error (a signature from errors top, or the
+                                       id or kind:key of its problem): time, user, function, session
+  logs container [<name|id> [--since 1h | --from <ISO> [--to <ISO>]] [--grep <regex>] [--limit 20000]]
+                                       A docker container's log lines (its latest --limit, then the
+                                       window and --grep); no name, the containers and their status
+  timeline --session <id> [--from <ISO|-15m>] [--to <ISO>] [--limit 500]
+                                       A session's events and requests in a window: no --from, the last
+                                       15 min; --to defaults to --from + 10 min, at most 2 h
+  logs cloud [--group <g>] [--since 1h | --from <ISO> [--to <ISO>]] [--filter <pattern>] [--limit 1000]
+                                       CloudWatch events; no --group, the instance's own group;
+                                       --filter is a CloudWatch filter pattern
+  logs archive list [--prefix <p>] [--since 7d] [--limit n]
+                                       Objects in the log archive (WORM bucket), by key; --since filters
+                                       only the page the server returned, so narrow it with --prefix
+  logs archive read <key>              One archived object decoded to events
+                                       logs cloud and logs archive take [--connection <id>]; without it,
+                                       the instance's AWS role
+  logs capture [<login|group> [--for 30m] [--reason <text>]]
+                                       Save every API request of a user or a group for a while: logger set
+                                       of saveHttpRequests on their expiring entry (an entry that already
+                                       expires later keeps its time); no argument, the active captures;
+                                       read them with timeline --session <id>
+  logs capture stop <login|group>      Remove that expiring entry; one that holds other settings is left
+                                       to logger set --remove
+
+Durations are 30m (minutes), 24h, 7d, 2w; times are ISO 8601 (UTC without an offset) or
+relative, written with = (--from=-2h).`;
+const UNIT_MS = {
+  m: 60000,
+  h: 3600000,
+  d: 86400000,
+  w: 604800000
+};
+
+/** `30m`, `2h`, `7d`, `1w` in milliseconds; `m` is minutes, unlike `grok s pull --since`, where it is months. */
+function parseDuration(value, flag) {
+  const m = /^(\d+)([mhdw])$/.exec(String(value ?? '').trim());
+  if (!m || Number(m[1]) <= 0) throw new Error(`${flag} expects a duration such as 30m, 2h, 7d or 1w, got '${value}'`);
+  return Number(m[1]) * UNIT_MS[m[2]];
+}
+
+/** ISO 8601 (UTC without an offset), or relative to [now] (`-2h`). */
+function parseTime(value, flag, now = new Date()) {
+  let s = String(value ?? '').trim();
+  if (s.startsWith('-')) return new Date(now.getTime() - parseDuration(s.substring(1), flag));
+  if (/[T ].*[+-]\d{2}$/.test(s)) s = `${s}:00`;
+  const d = new Date(/^\d{4}-\d{2}-\d{2}$/.test(s) || /(Z|[+-]\d{2}:?\d{2})$/i.test(s) ? s : `${s}Z`);
+  if (!/^\d{4}-\d{2}-\d{2}/.test(s) || isNaN(d.getTime())) throw new Error(`${flag} expects an ISO time (2026-10-04T06:00) or a relative one (-2h), got '${value}'`);
+  return d;
+}
+
+/** `a.b.0.c=<json>` applied to [target]; a value that is not JSON is a string. */
+function setPath(target, assignment) {
+  const at = assignment.indexOf('=');
+  if (at <= 0) throw new Error(`--set expects <path>=<json>, got '${assignment}'`);
+  const keys = assignment.slice(0, at).split('.');
+  const text = assignment.slice(at + 1);
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    value = text;
+  }
+  let node = target;
+  for (const key of keys.slice(0, -1)) node = node[key] ??= {};
+  node[keys[keys.length - 1]] = value;
+  return keys[0];
+}
+function readBody(argv) {
+  if (argv.json) return JSON.parse(fs.readFileSync(argv.json, 'utf8'));
+  if (argv.data !== undefined) return JSON.parse(String(argv.data));
+  throw new Error('Expected a body: --data \'<json>\' or --json <file>');
+}
+const iso = (value, flag) => value === undefined ? undefined : parseTime(value, flag).toISOString();
+
+/** A record as `field, value` rows, nested objects by dotted path, so a table shows every value in full. */
+function fieldRows(record, prefix = '') {
+  const rows = [];
+  for (const [key, value] of Object.entries(record ?? {})) if (value !== null && typeof value === 'object' && !Array.isArray(value)) rows.push(...fieldRows(value, `${prefix}${key}.`));else rows.push({
+    field: `${prefix}${key}`,
+    value
+  });
+  return rows;
+}
+async function handleObserve(dapi, command, verb, rest, argv, output) {
+  // A `:` cannot pass through a route parameter behind the proxy, so kind:key is looked up by the list's filters.
+  let id;
+  const needId = async () => {
+    const given = rest[0] === undefined ? '' : String(rest[0]);
+    const colon = given.indexOf(':');
+    if (!given || colon === 0 || colon === given.length - 1) throw new Error(`Usage: grok s observe ${command} ${verb} <id|kind:key>`);
+    if (colon < 0) {
+      id = given;
+      return;
+    }
+    const found = await dapi.problems.list({
+      kind: given.substring(0, colon),
+      key: given.substring(colon + 1),
+      limit: 1
+    });
+    if (!found?.length) throw new Error(`No problem '${given}'`);
+    id = found[0].id;
+  };
+  const problemPath = () => `/problems/${encodeURIComponent(id)}`;
+  // The route answers JSON as text/plain.
+  const settings = async key => {
+    const r = await dapi.raw('GET', `/admin/plugins/${key}/settings`);
+    return (typeof r === 'string' ? JSON.parse(r) : r)?.settings ?? {};
+  };
+  // A save within 5 s of the previous one is refused (429) until that one is applied.
+  const saveSettings = async (key, body) => {
+    for (let attempt = 0;; attempt++) {
+      try {
+        return await dapi.raw('POST', `/admin/plugins/${key}/settings`, body);
+      } catch (e) {
+        if (attempt >= 2 || e?.apiError?.errorCode !== 429) throw e;
+        await new Promise(resolve => setTimeout(resolve, 5000));
+      }
+    }
+  };
+  const saveLogger = body => saveSettings('logger', body);
+  switch (`${command} ${verb}`) {
+    case 'problems list':
+      (0, _serverOutput.printOutput)(await dapi.problems.list({
+        status: argv.status,
+        state: argv.state,
+        alertStatus: argv['alert-status'],
+        kind: argv.kind,
+        key: argv.key,
+        since: argv.since,
+        limit: argv.limit
+      }), output);
+      return true;
+    case 'problems get':
+      {
+        await needId();
+        const problem = await dapi.problems.find(id);
+        if (!problem) throw new Error(`No problem '${rest[0]}'`);
+        (0, _serverOutput.printOutput)(output === 'table' ? fieldRows(problem) : problem, output);
+        return true;
+      }
+    case 'problems history':
+      await needId();
+      (0, _serverOutput.printOutput)(await dapi.raw('GET', `${problemPath()}/history${(0, _nodeDapi.buildQuery)({
+        limit: argv.limit
+      })}`), output);
+      return true;
+    case 'problems status':
+      await needId();
+      (0, _serverOutput.printOutput)(await dapi.raw('POST', `${problemPath()}/status`, readBody(argv)), output);
+      return true;
+    case 'problems ack':
+    case 'problems resolve':
+      await needId();
+      (0, _serverOutput.printOutput)(await dapi.raw('POST', `${problemPath()}/${verb}`, {
+        reason: argv.reason
+      }), output);
+      return true;
+    case 'rules get':
+      {
+        const rules = (await settings('alerts'))?.problemRules;
+        (0, _serverOutput.printOutput)(rules ? JSON.parse(rules) : [], output === 'table' ? 'json' : output);
+        return true;
+      }
+    case 'rules put':
+      {
+        const rules = readBody(argv);
+        await saveSettings('alerts', {
+          problemRules: typeof rules === 'string' ? rules : JSON.stringify(rules)
+        });
+        if (output !== 'quiet') console.log('Saved the problem rules');
+        return true;
+      }
+    case 'rules test':
+      console.log(await dapi.raw('POST', '/alerts/Test_rules'));
+      return true;
+    case 'logger get':
+      {
+        let value = await settings('logger');
+        for (const key of rest[0] ? String(rest[0]).split('.') : []) value = value?.[key];
+        (0, _serverOutput.printOutput)(value, output === 'table' ? 'json' : output);
+        return true;
+      }
+    case 'logger set':
+      return loggerSet(dapi, argv, await settings('logger'), saveLogger, output);
+    case 'logger history':
+      {
+        const text = encodeURIComponent('eventType.name = "log-settings-changed"');
+        const events = (await dapi.raw('GET', `/log?text=${text}&limit=${argv.limit ?? 20}&page=1`)) ?? [];
+        (0, _serverOutput.printOutput)(events.map(e => {
+          const params = {};
+          for (const p of e.parameters ?? []) params[p.parameter?.name] = p.value;
+          const row = {
+            time: e.eventTime,
+            user: params.user,
+            changed: params.changed
+          };
+          return output === 'table' ? row : {
+            ...row,
+            diff: params.diff ? (0, _nodeDapi.tryParseJson)(params.diff) ?? params.diff : null
+          };
+        }), output);
+        return true;
+      }
+    case 'errors top':
+      {
+        if (argv.since !== undefined && (argv.from !== undefined || argv.date !== undefined)) throw new Error('--since is not used with --from or --date');
+        if (argv.date !== undefined && argv.from !== undefined) throw new Error('--date is not used with --from');
+        const metrics = await dapi.raw('GET', `/admin/metrics${(0, _nodeDapi.buildQuery)({
+          date_start: argv.since !== undefined ? new Date(Date.now() - parseDuration(argv.since, '--since')).toISOString() : iso(argv.from, '--from'),
+          date_end: iso(argv.to, '--to'),
+          date: argv.date,
+          limit: argv.limit,
+          errors_by: argv.by,
+          package: argv.package,
+          user: argv.user,
+          source: argv.source
+        })}`);
+        // The server answers the top `limit` of every source, in the global order.
+        const top = (metrics?.errors?.top ?? []).slice(0, Number(argv.limit ?? 10));
+        (0, _serverOutput.printOutput)(output === 'json' ? {
+          ...metrics?.errors,
+          top
+        } : top, output);
+        return true;
+      }
+    case 'errors get':
+      {
+        if (rest[0] === undefined) throw new Error('Usage: grok s observe errors get <signature|problem id|kind:key> [--since 7d] [--limit 50]');
+        const given = String(rest[0]);
+        if (given.includes(':')) await needId();
+        const problem = await dapi.problems.find(id ?? given);
+        const signature = problem ? problem.details?.signatureId : given;
+        if (!signature) throw new Error(`Problem '${given}' is not about an error: it has no signatureId`);
+        // An error with a stack is grouped by its stack hash, one without by its event type (ErrorIncidentProblem).
+        const text = `(eventType.id = "${signature}" or eventType.errorStackTraceHash = "${signature}") and ` + `eventTime > "${new Date(Date.now() - parseDuration(argv.since ?? '7d', '--since')).toISOString()}"`;
+        const events = (await dapi.raw('GET', `/log${(0, _nodeDapi.buildQuery)({
+          text,
+          limit: argv.limit ?? 50,
+          page: 1
+        })}`)) ?? [];
+        const logins = new Map();
+        for (const e of events) for (const p of e.parameters ?? []) if (p.parameter?.name === 'user' && p.value && !logins.has(p.value)) logins.set(p.value, (await dapi.users.find(p.value))?.login ?? p.value);
+        (0, _serverOutput.printOutput)(events.map(e => {
+          const params = {};
+          for (const p of e.parameters ?? []) params[p.parameter?.name] = p.value;
+          const row = {
+            time: e.eventTime,
+            source: params.source,
+            user: logins.get(params.user) ?? null,
+            function: params.function ?? null,
+            session: e.session?.id ?? null,
+            message: e.description
+          };
+          return output === 'table' ? row : {
+            ...row,
+            eventId: e.id,
+            params
+          };
+        }), output);
+        return true;
+      }
+  }
+  if (command === 'logs' && verb === 'capture') return capture(dapi, rest, argv, await settings('logger'), saveLogger, output);
+  if (command === 'logs') return logs(dapi, verb, rest, argv, output);
+  if (command === 'timeline') {
+    if (argv.session === undefined) throw new Error('Usage: grok s observe timeline --session <id> [--from <ISO|-15m>] [--to <ISO>] [--limit 500]');
+    needFrom(argv);
+    const window = argv.from === undefined ? {
+      from: iso('-15m', '--from'),
+      to: new Date().toISOString()
+    } : {
+      from: iso(argv.from, '--from'),
+      to: iso(argv.to, '--to')
+    };
+    (0, _serverOutput.printOutput)(await dapi.raw('GET', `/log/timeline${(0, _nodeDapi.buildQuery)({
+      session: argv.session,
+      ...window,
+      limit: argv.limit
+    })}`), output);
+    return true;
+  }
+  throw new Error(`Unknown command '${[command, verb].filter(Boolean).join(' ')}'\n${OBSERVE_USAGE}`);
+}
+const needFrom = argv => {
+  if (argv.to !== undefined && argv.from === undefined) throw new Error('--to needs --from');
+};
+async function logs(dapi, verb, rest, argv, output) {
+  const connection = argv.connection;
+  if (verb === 'cloud') {
+    if (argv.since !== undefined && argv.from !== undefined) throw new Error('--since is not used with --from');
+    needFrom(argv);
+    const group = argv.group ?? (await dapi.raw('GET', `/log/cloud/groups${(0, _nodeDapi.buildQuery)({
+      connection
+    })}`))?.[0];
+    if (!group) throw new Error('No log group to read: pass --group');
+    const window = argv.from !== undefined ? {
+      start: iso(argv.from, '--from'),
+      end: iso(argv.to, '--to')
+    } : {
+      start: new Date(Date.now() - parseDuration(argv.since ?? '1h', '--since')).toISOString()
+    };
+    (0, _serverOutput.printOutput)(await dapi.raw('GET', `/log/cloud/events${(0, _nodeDapi.buildQuery)({
+      connection,
+      group,
+      ...window,
+      filter: argv.filter,
+      limit: argv.limit,
+      format: 'json'
+    })}`), output);
+    return true;
+  }
+  if (verb === 'container') return containerLogs(dapi, rest[0], argv, output);
+  if (verb === 'archive' && rest[0] === 'list') {
+    let objects = (await dapi.raw('GET', `/log/archive/objects${(0, _nodeDapi.buildQuery)({
+      connection,
+      prefix: argv.prefix,
+      limit: argv.limit,
+      format: 'json'
+    })}`)) ?? [];
+    if (argv.since !== undefined) {
+      const from = Date.now() - parseDuration(argv.since, '--since');
+      objects = objects.filter(o => Date.parse(o.modified) >= from);
+    }
+    (0, _serverOutput.printOutput)(objects, output);
+    return true;
+  }
+  if (verb === 'archive' && rest[0] === 'read' && rest[1] !== undefined) {
+    (0, _serverOutput.printOutput)(await dapi.raw('GET', `/log/archive/events${(0, _nodeDapi.buildQuery)({
+      connection,
+      key: rest[1],
+      format: 'json'
+    })}`), output);
+    return true;
+  }
+  throw new Error('Usage: grok s observe logs cloud [--group <g>] ... | logs container [<name|id>] | ' + 'logs archive list [--prefix <p>] | logs archive read <key> | logs capture [<login|group>] | ' + 'logs capture stop <login|group>');
+}
+
+/// `logs container`: the server only cuts a container's log by line count, so the window and --grep apply here.
+async function containerLogs(dapi, name, argv, output) {
+  if (name === undefined) {
+    const all = (await dapi.raw('GET', `/docker/containers${(0, _nodeDapi.buildQuery)({
+      limit: 1000
+    })}`)) ?? [];
+    (0, _serverOutput.printOutput)(all.map(c => ({
+      id: c.id,
+      name: c.name,
+      status: c.status
+    })), output);
+    return true;
+  }
+  if (argv.since !== undefined && argv.from !== undefined) throw new Error('--since is not used with --from');
+  needFrom(argv);
+  let id = String(name);
+  if (!_nodeDapi.UUID_RE.test(id)) {
+    const found = (await dapi.raw('GET', `/docker/containers${(0, _nodeDapi.buildQuery)({
+      text: id,
+      limit: 100
+    })}`)) ?? [];
+    const container = found.find(c => c.name === id);
+    if (!container) throw new Error(`No container '${id}'${found.length ? `; similar: ${found.map(c => c.name).join(', ')}` : ''}`);
+    id = container.id;
+  }
+  const from = argv.from !== undefined ? parseTime(argv.from, '--from').getTime() : argv.since !== undefined ? Date.now() - parseDuration(argv.since, '--since') : -Infinity;
+  const to = argv.to !== undefined ? parseTime(argv.to, '--to').getTime() : Infinity;
+  const grep = argv.grep === undefined ? null : new RegExp(String(argv.grep), 'i');
+  const text = await dapi.raw('GET', `/docker/containers/${id}/logs${(0, _nodeDapi.buildQuery)({
+    limit: argv.limit ?? 20000
+  })}`);
+  // A line without its own timestamp (a stack frame) belongs to the window of the line before it.
+  let inWindow = from === -Infinity && to === Infinity;
+  const lines = [];
+  for (const line of String(text ?? '').split('\n')) {
+    const stamp = /^(\d{4}-\d{2}-\d{2}T[\d:]{8})(?:\.\d+)?(Z|[+-]\d{2}:\d{2})/.exec(line);
+    if (stamp) {
+      const t = Date.parse(`${stamp[1]}${stamp[2]}`);
+      inWindow = t >= from && t <= to;
+    }
+    if (inWindow && line && (!grep || grep.test(line))) lines.push(line);
+  }
+  if (output === 'json') (0, _serverOutput.printOutput)(lines, output);else for (const line of lines) console.log(line);
+  return true;
+}
+async function loggerSet(dapi, argv, current, save, output) {
+  const sets = argv.set === undefined ? [] : (Array.isArray(argv.set) ? argv.set : [argv.set]).map(String);
+  const entry = argv.user !== undefined || argv.group !== undefined || argv.target !== undefined;
+  if (!sets.length && !entry) throw new Error('Usage: grok s observe logger set --set <path>=<json> ... [--user <login> | --group <name|id>]');
+  if (!entry && (argv.for !== undefined || argv.until !== undefined || argv.reason !== undefined || argv.remove)) throw new Error('--for, --until, --reason and --remove apply to a --user or --group entry');
+  const name = argv.user ?? argv.group ?? argv.name;
+  if (!entry) {
+    const body = {};
+    for (const s of sets) {
+      const key = setPath(current, s);
+      body[key] = current[key];
+    }
+    await save(body);
+  } else {
+    const group = argv.target ?? (argv.user !== undefined ? await dapi.groups.resolve(String(argv.user), {
+      personalOnly: true
+    }) : await dapi.groups.resolve(String(argv.group)));
+    const groups = {
+      ...current.userGroupSettings
+    };
+    const existing = groups[group.id];
+    if (argv.remove) {
+      if (!existing) throw new Error(`${name} has no logger entry`);
+      delete groups[group.id];
+    } else {
+      if (existing && !existing.expiresAt && (argv.for !== undefined || argv.until !== undefined)) throw new Error(`${name} has a logger entry that does not expire; change it without --for or --until`);
+      // A user's settings come from one entry, so a new one starts from All users instead of the defaults.
+      const settings = existing ? {
+        ...existing
+      } : {
+        ...groups[_walker.ALL_USERS]
+      };
+      if (!existing) delete settings.reason;
+      for (const s of sets) setPath(settings, s);
+      if (argv.for !== undefined) settings.expiresAt = new Date(Date.now() + parseDuration(argv.for, '--for')).toISOString();else if (argv.until !== undefined) {
+        settings.expiresAt = iso(argv.until, '--until');
+        if (Date.parse(settings.expiresAt) <= Date.now()) throw new Error(`--until ${argv.until} is in the past`);
+      }
+      if (argv.reason !== undefined) settings.reason = String(argv.reason);
+      groups[group.id] = settings;
+    }
+    await save({
+      userGroupSettings: groups
+    });
+  }
+  if (output !== 'quiet') console.log(!entry ? 'Saved the logger settings' : argv.remove ? `Removed the logger entry of ${name}` : `Saved the logger settings of ${name}`);
+  return true;
+}
+
+/// `logs capture`: logger set of saveHttpRequests, and the usage level it is saved at, on an expiring entry.
+async function capture(dapi, rest, argv, current, save, output) {
+  const groups = current.userGroupSettings ?? {};
+  const stop = rest[0] === 'stop';
+  const name = stop ? rest[1] : rest[0];
+  if (name === undefined) {
+    if (stop) throw new Error('Usage: grok s observe logs capture stop <login|group>');
+    const rows = [];
+    for (const [id, s] of Object.entries(groups)) if (s?.saveHttpRequests === true && s.expiresAt) {
+      const group = await dapi.groups.find(id);
+      rows.push({
+        id,
+        name: group?.friendlyName ?? group?.name ?? id,
+        expiresAt: s.expiresAt,
+        reason: s.reason ?? ''
+      });
+    }
+    (0, _serverOutput.printOutput)(rows, output);
+    return true;
+  }
+  let group;
+  try {
+    group = await dapi.groups.resolve(String(name), {
+      personalOnly: true
+    });
+  } catch {
+    group = await dapi.groups.resolve(String(name));
+  }
+  const existing = groups[group.id];
+  if (stop) {
+    if (!existing?.saveHttpRequests) throw new Error(`No capture for ${name}`);
+    if (!existing.expiresAt) throw new Error(`The logger entry of ${name} does not expire; change it with logger set`);
+    const own = ['saveHttpRequests', 'postLevels', 'saveLevels', 'expiresAt', 'reason'];
+    const others = Object.keys(existing).filter(k => !own.includes(k) && JSON.stringify(existing[k]) !== JSON.stringify(groups[_walker.ALL_USERS]?.[k]));
+    if (others.length) throw new Error(`The logger entry of ${name} also holds ${others.join(', ')}; remove it with ` + `grok s o logger set --${group.personal ? 'user' : 'group'} ${name} --remove`);
+    return loggerSet(dapi, {
+      target: group,
+      name,
+      remove: true
+    }, current, save, output);
+  }
+  const base = existing ?? groups[_walker.ALL_USERS] ?? {};
+  const sets = ['saveHttpRequests=true', ...['postLevels', 'saveLevels'].filter(l => Array.isArray(base[l]) && !base[l].includes('usage')).map(l => `${l}=${JSON.stringify([...base[l], 'usage'])}`)];
+  const end = Math.max(Date.now() + parseDuration(argv.for ?? '30m', '--for'), Date.parse(existing?.expiresAt) || 0);
+  return loggerSet(dapi, {
+    target: group,
+    name,
+    set: sets,
+    reason: argv.reason,
+    until: new Date(end).toISOString()
+  }, current, save, output);
+}

package/bin/commands/server.js

@@ -15,6 +15,7 @@ var _serverClient = require("../utils/server-client");
 var _serverOutput = require("../utils/server-output");
 var _serverMigrate = require("./server-migrate");
 var _serverDomains = require("./server-domains");
+var _serverObserve = require("./server-observe");
 var _registry = require("../utils/migrate/registry");
 var _walker = require("../utils/migrate/walker");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
@@ -27,7 +28,7 @@ const ENTITY_TYPES = {
   reports: 'UserReport'
 };
 const ENTITIES = ['users', 'groups', 'functions', 'connections', 'queries', 'scripts', 'packages', 'reports', 'files', 'tables'];
-const COMMANDS = ['shares', 'domains', 'raw', 'batch', 'describe', 'healthcheck', 'sync', 'pull', 'push', 'migrate', 'diff', 'bundle', 'token'];
+const COMMANDS = ['shares', 'domains', 'raw', 'batch', 'describe', 'healthcheck', 'sync', 'pull', 'push', 'migrate', 'diff', 'bundle', 'token', 'observe', 'o'];
 const VERBS = ['list', 'count', 'get', 'delete'];
 async function server(argv) {
   const args = argv['_'].slice(1);
@@ -45,6 +46,10 @@ async function server(argv) {
     console.log(HELP_SERVER);
     return true;
   }
+  if ((entity === 'observe' || entity === 'o') && !verb) {
+    console.log(_serverObserve.OBSERVE_USAGE);
+    return true;
+  }
   let client;
   try {
     client = await (0, _serverClient.createClient)(host, !!argv.admin);
@@ -60,6 +65,7 @@ async function server(argv) {
     // escaping to grok.js as an unhandled rejection (stack trace + exit 255)
     if (['pull', 'push', 'migrate', 'diff', 'bundle'].includes(entity)) return await (0, _serverMigrate.handleMigrate)(dapi, entity, [verb, ...rest].filter(Boolean), argv, output);
     if (entity === 'domains') return await (0, _serverDomains.handleDomains)(dapi, verb, rest, argv, output);
+    if (entity === 'observe' || entity === 'o') return await (0, _serverObserve.handleObserve)(dapi, verb, rest[0], rest.slice(1), argv, output);
     if (entity === 'batch') return await handleBatch(dapi, argv, verb, rest, output);
     // Shell scripts that used to curl /users/login/dev get a token the same way
     // every other command does, whatever credential the config holds.
@@ -927,6 +933,7 @@ Manage a Datagrok server from the command line.
 Entities:
   users, groups, functions, connections, queries, scripts, packages, reports, files, tables
   (plus domains, shares, batch, raw, describe, healthcheck, sync, pull/push/migrate/diff/bundle below)
+  observe (alias o): problems, problem rules, logger settings, errors, timeline, cloud logs; grok s observe prints its verbs
 
 Verbs:
   list      List entities (--filter, --limit, --offset)

package/bin/grok.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
+// minimist sets every boolean option to false when it is absent, and commands such as `grok api`
+// reject any key they do not expect — so each boolean reaches only the commands that read it.
+const commandBooleans = {dartium: ['test', 'stresstest'], 'send-email': ['server', 's']};
 const argv = require('minimist')(process.argv.slice(2), {
   alias: {k: 'key', h: 'help', r: 'recursive'},
-  boolean: ['dartium', 'send-email'],
+  boolean: Object.keys(commandBooleans),
   // keep versions verbatim — minimist would coerce '1.10' to the number 1.1
   string: ['version', 'prefix'],
 });
@@ -59,8 +62,9 @@ function printUsage(command) {
 }
 
 const command = argv['_'][0];
-if (command !== 'test' && command !== 'stresstest')
-  delete argv.dartium;
+for (const [flag, owners] of Object.entries(commandBooleans))
+  if (!owners.includes(command))
+    delete argv[flag];
 if (command in commands) {
   try {
     if (argv['help']) {

package/bin/utils/ent-helpers.js

@@ -12,7 +12,7 @@ const domainApp = (appNames, tables) => `
 The application${appNames.length > 1 ? 's' : ''} ${appNames.join(', ')} ` + `(over ${tables.join(', ')}) ${appNames.length > 1 ? 'have' : 'has'} been added successfully
 
 Next steps:
-  pnpm install                   link @datagrok-libraries/u2 (a workspace dependency)
+  pnpm install                   link @datagrok-libraries/ems (a workspace dependency)
   grok build && grok publish     publish the package and open the app from the browse tree
 
 The app is the u2 defaults alone — list, search, filters, entity page with children

package/bin/utils/migrate/walker.js

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.ALL_USERS = void 0;
 exports.collectExternals = collectExternals;
 exports.compileFilter = compileFilter;
 exports.expand = expand;
@@ -28,7 +29,7 @@ const noProgress = () => {};
 
 /** What the bundle points at but does not carry: resolvable on the source, or dead there too. */
 
-const ALL_USERS = 'a4b45840-9a50-11e6-9cc9-8546b8bf62e6';
+const ALL_USERS = exports.ALL_USERS = 'a4b45840-9a50-11e6-9cc9-8546b8bf62e6';
 
 /** One round trip per entity, tens of thousands per stand — modest, since the server is shared. */
 const WALK_CONCURRENCY = 12;

package/bin/utils/migrate/walker.ts

@@ -30,7 +30,7 @@ export interface External {id: string; type: string; nqName: string}
 /** What the bundle points at but does not carry: resolvable on the source, or dead there too. */
 export interface Outside {externals: External[]; dangling: string[]}
 
-const ALL_USERS = 'a4b45840-9a50-11e6-9cc9-8546b8bf62e6';
+export const ALL_USERS = 'a4b45840-9a50-11e6-9cc9-8546b8bf62e6';
 
 /** One round trip per entity, tens of thousands per stand — modest, since the server is shared. */
 const WALK_CONCURRENCY = 12;