Table of Contents

Egress Audit

Last updated:

The egress audit shows recorded moments when Oscova sent data outside this machine. Use it to answer what external service was used, when it was used, and which chat, task, agent, provider, model, or tool was involved.

Note

Egress means data left this machine for a cloud model provider, an internet-connected tool, a connected-channel reply, or a cloud embedding model.

Open the audit

Open Dashboard, then click the Egress card.

The dialog starts on Last 30 days, matching the dashboard window. Choose All time to browse the stored audit log beyond the dashboard window.

Admins opening the audit from a system-wide dashboard can see rows across users. In that mode, the table includes a User column.

Read the summary

The audit summary shows:

  • Total events: all matching egress rows for the active filters.
  • Provider events: chat or task model provider calls.
  • Tool events: internet-connected tool calls.
  • Embedding events: memory indexing or memory search calls that used a cloud embedding provider.
Note

Local-only model work does not appear in the egress audit because no data left the machine.

Filter events

Use the filter row to narrow the audit:

  • Range: Last 30 days or All time.
  • Kind: all kinds, provider, tool, or embedding.
  • Source: all sources, chat, task, memory indexing, or memory search.
  • Search egress: search event metadata such as thread, run, task, agent, provider, model, tool, kind, source, and, for admin system scope, owner information.

Press Enter in the search box or click Search. Click Refresh to reload the current page and filters.

The dialog shows 50 rows per page. Use the page controls when more rows match.

Read event rows

Each row shows:

  • Time: the local time when the event was recorded.
  • Type: provider, tool, or embedding.
  • Destination: the tool name, or the provider and model when available.
  • Source: chat, task, memory indexing, or memory search.
  • Agent: the agent associated with the event when known.
  • Context: the thread title, task name, thread ID, or task ID.
  • User: shown only for admin system-wide review.
  • Inspect: shown for chat and task-run rows when the related session is available to you.

Expand a row to see technical metadata:

  • Thread ID.
  • Run ID.
  • Task ID.
  • Provider ID.
  • Model.
  • Tool.

These IDs are useful when you are matching an audit event to a specific chat thread, scheduled task run, or provider configuration.

Rows tied to a chat thread or task run can open Session Inspector directly from the audit table. Use Inspect when you need to move from "egress happened" to the saved conversation, tool calls, system instruction, and evidence JSON behind that event.

Embedding rows do not have a chat or task session to inspect. In system-wide admin scope, Oscova only lets you inspect sessions owned by your current account. Other users' rows remain visible for audit, but their private session transcript is not opened from this dialog.

What appears here

The audit records provider, tool, and embedding egress events. Examples include:

  • A chat or task using a hosted model provider.
  • A task using an internet-connected tool.
  • A Discord or Telegram run sending its outbound reply.
  • Memory indexing or memory search using a cloud embedding model.

Inbound Discord and Telegram gateway, polling, and attachment traffic does not appear in the run ledger. That traffic brings messages or files into Oscova. Only the outbound reply carries run output to the channel service.

Local-only activity does not appear as egress. For example, a local model response may still appear in dashboard token totals, but it does not create an egress event if the model call stayed on this machine.

Troubleshooting

  • No audit entries match the current filters: switch to All time, clear search text, or choose All kinds and All sources.
  • Inspect is not shown: the row may be an embedding entry, may not have a saved thread or run ID, or may belong to another user in system-wide admin scope.
  • Inspect says the session is unavailable: the related chat thread or task run may have been deleted after the audit event was recorded.
  • Expected local work is missing: local-only model work is intentionally excluded from egress.
  • Expected cloud work is missing: clear the filters, refresh the audit, and check application logs for egress audit warnings.
  • Destination says unknown: the event was recorded without a provider, model, or tool label. Expand the row and use the available IDs to continue tracing.
  • The audit cannot load: refresh the dialog. If it still fails, check application logs for egress audit errors.
Caution

The audit tells you that egress happened and records the related destination and context. It is not a full copy of every prompt, attachment, or response sent to an external service.