What to watch

• cardinal decisions -denied when somebody reports they cannot reach something. The refusal names the rule, or says nothing matched.
• cardinal audit verify on a schedule, and after every restore.
• The journal's fingerprint, copied off the host on a schedule, and the newest copy checked with cardinal journal verify. GET /api/journal/head with an access token carrying only the journal scope is enough for the copy, and cheap enough to call hourly (the audit journal).
• The administrators' digest arriving, numbered without gaps.
• The agent's doctor subcommand on a host that is behaving oddly; it compares its own version against the server's, which is otherwise invisible.
• From 0.6.4, the image's HEALTHCHECK, which runs cardinal-server healthcheck (0.6.3's notes announced it, but its image lacked it): it asks /api/health on loopback and passes only on a 200 with status ok, so docker compose ps shows the server as healthy, and fails when the database is unreachable. It reads /etc/cardinal/cardinal.toml for the listen port, like the image's default command; a deployment serving from another file overrides the health check with the same -config.
• /api/health, which a probe already polls: besides the build and the policy version, alerts says delivering, or held: and why while nobody is being told anything: mail is off, or no administrator has an email address (administrator alerts).

What the startup log says

Worth reading once, because several of these are the only place a condition is reported:

• the schema being ahead of the binary, which is supported and normal;
• a policy version activated but not compiling, so the previous set is still being enforced;
• a partitioned table with under two years of runway, or writing into its backstop;
• development mode, which relaxes cookie security and should never appear in production.

What is not covered

There is no metrics endpoint and no Prometheus exporter. The administrator alerts cover changes to the directory, not the health of delivery: failing mail and failing event delivery are visible in the console and in cardinal mail status and cardinal ssf status, and nothing tells you about them: somebody has to look.