logs shows entries from the audit log, which holds one record for each command CC Safety Net allowed or blocked. With no flags it prints the 20 most recent denials from the last 30 days, across every project. Pass --all to include allowed decisions.
logs filters and options
Find likely false positives with --suspect
--suspect shows only denials worth a second look. A denial qualifies when either of these is true:
- It carries a
failureStage, which means the analysis failed and CC Safety Net blocked the command without proving it dangerous. - The same command was denied two or more times in the same session.
logs flag conflicts and errors
--id combines only with --all and --json. --prune-legacy combines only with --json and --dry-run, and --dry-run requires --prune-legacy. Any other combination, or an unknown option, prints an error naming the problem and exits 1.
If logs cannot read an audit log file or finds a malformed record, it prints one warning to stderr. The entries on stdout and the exit code stay the same:
logs output
Without--json, logs prints one row per entry. Each row shows the id, timestamp, decision, agent, rule id, and the command cut to 50 characters. The ↳ marker shows a segment that differs from the full command.
With --id, logs instead prints a labelled block with every field of the record.
logs JSON output
Delete legacy log files
logs --prune-legacy deletes every *.jsonl file directly in the audit root, whatever its age or content. Those files use the legacy layout.
--prune-legacy never touches the per-project audit logs in subdirectories. It exits 0 when every deletion succeeded and 1 if any file could not be removed.
See Audit log for the difference between the legacy layout and the current one.
Preview the deletion with --dry-run
With --dry-run, the command deletes nothing and exits 0. It prints Would remove <n> legacy audit log files (<size>). or No legacy audit log files found. With --json, it prints the object shown in logs JSON output.