[observability] Observability Coverage Report - 2026-07-29

[github-actions[bot]]

Executive Summary

Sampled 3 completed runs from the last 7 days. Every sampled run had access.log plus MCP telemetry (rpc-messages.jsonl) present, so the debug path is intact for both AWF Firewall and the MCP gateway. No critical observability gaps were found in this sample.

The main quality caveat is that all firewall logs were allow-only; this sample does not exercise blocked traffic. MCP telemetry was present via the canonical fallback (rpc-messages.jsonl) rather than gateway.jsonl, but it parsed cleanly.

Key Alerts and Anomalies

No critical issues detected.

⚠️ Warnings:

• Firewall logs were allow-only in all sampled runs, so there is no blocked-request evidence in this sample.
• MCP telemetry was recorded via rpc-messages.jsonl in all sampled runs; no gateway.jsonl file was observed.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	3	3	100%	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	3	3	100%	✅

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Daily BYOK Ollama Test	30405288231	✅	15	15	0	⚠️
Daily Reliability Review	30407240467	✅	112	112	0	⚠️
Detection Analysis Report	30408045380	✅	125	125	0	⚠️

Missing Firewall Logs (access.log)

None.

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily BYOK Ollama Test	30405288231	rpc-messages.jsonl	present	n/a	n/a	0	✅
Daily Reliability Review	30407240467	rpc-messages.jsonl	present	n/a	n/a	0	✅
Detection Analysis Report	30408045380	rpc-messages.jsonl	present	n/a	n/a	0	✅

Missing MCP Telemetry

None.

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 252
• Blocked requests: 0 (0%)
• Allowed requests: 252 (100%)
• Unique domains observed: 4
• Most accessed domains: api.anthropic.com:443, o205451.ingest.us.sentry.io:443, host.docker.internal:443, otlp-gateway-prod-eu-west-2.grafana.net:443

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl fallback on all sampled runs
• MCP telemetry was present and parseable on all sampled runs
• No parse errors or MCP server failures surfaced in the sampled set
• Gateway-level counts were available in the raw run artifacts, but the compact summary only needed coverage validation here

Healthy Runs Summary

• Daily BYOK Ollama Test failed, but still preserved both firewall and MCP telemetry for debugging.
• Daily Reliability Review and Detection Analysis Report completed successfully with complete observability coverage.

Recommended Actions

1. Keep the current log capture path intact, since both firewall and MCP telemetry were recoverable in every sampled run.
2. Add at least one run or test case that produces blocked firewall traffic so deny-path logging is exercised in the sample.
3. Prefer emitting gateway.jsonl in addition to rpc-messages.jsonl so MCP telemetry is easier to analyze without relying on the fallback path.

📊 Historical Trends

No prior baseline was evaluated for this daily sample.

References:

• §30405288231
• §30407240467
• §30408045380

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 3

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 · 61.5 AIC · ⌖ 3.59 AIC · ⊞ 12.9K · ◷

• expires on Jul 29, 2026, 4:13 PM UTC-08:00

[mcdev7777]

Great to see complete log and MCP telemetry coverage across all sampled runs. Adding a test that deliberately triggers blocked firewall traffic would help validate the warning and error paths, not just successful requests.

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #49012.