Monitoring and evidence

Roost reports its own health, exports every record to your monitoring systems, and produces the evidence auditors ask for, signed.

Metrics

Metric	Meaning	Watch for
Active and idle sessions	Per client and per box	Idle sessions that never close
Round-trip time	Request to answer, p50 and p99	Growth under load; network problems
Pair sync delay	Time for a piece or a key version to reach the second box	A pair drifting apart
Signs per minute	Per key and per client	Bursts: a compromised client or agent
Refusals	Per rule	A rule refusing legitimate traffic

axowl.com/dashboard/acme/roost/alerts

AxowlacmeRoostM

Alerts

0red

1yellow

2boxes green

Item	Yellow	Red	ROOST-26-0001	ROOST-26-0002
Chip temperature	≥ 80 °C	≥ 90 °C	46–50 °C	45–49 °C
Mesh resistance	± 1 %	± 1.5 %	100.1 %	99.9 %
Voter quorum	2 of 3	< 2	3 of 3	3 of 3
Time sync	> 100 ms	> 500 ms	8 ms	11 ms
Battery 2	< 2.7 V	< 2.5 V	3.61 V	2.68 V
Signs per minute	> 3× baseline	> 10× baseline	41	38

Recipients: owner · roost admins · soc@acme.example · SNMPv3 nms.acme.example

Alerts: thresholds per item and box; red pages at once, yellow after five minutes.

Export

Syslog over TLS or RELP and SNMPv3 traps carry every audit event with the actor, the correlation id and the audit record id, so a line in your SIEM ties back to a sealed record. The actor id is the same one your login and approval records use. See Audit-log export for the fields.

Evidence reports

Report	Shows	Used for
Event export	Every event in a period with chain verification	SOC 2, PCI DSS
Key attribute report	Every key, its purpose, export never, versions, birth or import record	FIPS 140 programs, PCI DSS
Access review matrix	Who holds which role and partition, including agents	ISO 27001, SOC 2

axowl.com/dashboard/acme/roost/records/reports

AxowlacmeRoostM

Evidence reports

Report	Scope	Period	Signed by
Event export	all partitions	2026 Q3	ROOST-26-0001 identity key	Download
Key attribute report	prod · payments	as of today	ROOST-26-0001 identity key	Download
Access review matrix	all	as of today	ROOST-26-0001 identity key	Download
Chain verification	all	last 90 days	verified by M. Lee (auditor)	0 gaps

Each report is produced by the appliance and signed; auditors verify the signature with the published identity key.

Evidence reports: produced and signed by the appliance, ready for an audit.

roost report key-attributes --partition prod --out keys-2026-Q4.pdf
# produced by the appliance and signed with the box identity key; the auditor verifies the signature

Risk score

Each key and each client, agents included, has a risk score from its behaviour: sudden bursts, attempts without approval, long-unused keys suddenly used. A high score raises an alert before a rule is tripped.