Operations

This section is for whoever keeps the sentinel running after it is deployed — a platform or SRE hat more than an agent-author one. By the end you will know what the sentinel stores on disk and for how long, how warning-level noise stays bounded, how to verify the sentinel is healthy and what to alert on, and what its startup errors mean.

Day-2 material for a deployed sentinel (deploying it in the first place is Getting started → Deploy the sentinel):

• The occurrence store — what --store records, its TTL/size bounds, copying it off a pod for post-mortems, --at time-travel queries, and epoch semantics across restarts.
• The watchboard — how warning-class noise is batched into digests, the size-based rotation lifecycle, and lineage.
• Drills & verification — the staged-failure runbooks in dev/drills/ and when to run them.
• Observing lookout — the Prometheus metrics, /healthz, startup-log verification, and what to alert on.
• Troubleshooting — RBAC probe failures, source-by-source requirements, common startup errors verbatim, and what the unavailable markers mean.
• Scoping a sentinel — narrowing what one sentinel watches: --exclude-namespace as a real watch scope, why --namespace is not one, and which sources can be split into their own deployment without paying for a second cache.

The generated lookout watch flag table and Prometheus metrics reference are the authoritative surfaces these pages link into.