Logs
Every process writes JSON slog to stdout (LATTICE_LOG_LEVEL). DHCP lines include node, xid, mac, ip, subnet_id, msg_type. Do not parse logs for lease truth — Postgres is the store.
systemd units inherit StandardOutput=journal:
journalctl -u lattice-dhcpd -u lattice-api -u lattice-worker -o json-pretty -n 20
Ship journald with Vector, rsyslog imjournal, or a node agent. Do not add a second log protocol inside dhcpd.
Metrics
Scrape from a private network. /metrics is unauthenticated.
- api
:8080/metrics - dhcpd HTTP (lab
:8082/:8083) - worker
:8081/metrics
Names: Metrics. Alert on /readyz != 200, lattice_outbox_lag, lattice_pool_free near 0, lattice_dns_updates_total{result="failed"}.
SIEM
Subscribe a webhook to ipam.audit (and lease topics if you want grants). Webhooks. Failures retry with the outbox; they never roll back the write.
Overview in the console derives the same picture from Postgres every 8s.