You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I reviewed a capped sample of 20 workflow runs from the last 7 days. Firewall observability is the weak spot: 18 sampled runs had firewall enabled, but only 11 included the Squid access.log, so 7 firewall-enabled failures are missing the log needed for network debugging. MCP telemetry is present in every sampled run via rpc-messages.jsonl; 11 files contain usable JSON-RPC traffic and 9 are zero-length placeholders from early-abort runs.
No run in the sample was missing both MCP telemetry files, so there are no MCP critical gaps. The main action item is to restore firewall log emission on failure paths.
Average response time: N/A from rpc-messages.jsonl
Healthy Runs Summary
11 sampled runs had both firewall logs and usable MCP telemetry.
9 sampled runs need early-exit telemetry fixes because both access.log and the RPC payload content were missing.
Recommended Actions
Make firewall log emission durable on failure paths so access.log is flushed even when the run aborts early.
Add an explicit startup/teardown heartbeat for MCP telemetry so zero-length rpc-messages.jsonl files are distinguishable from successful toolless runs.
Keep the fallback RPC capture path in place until gateway.jsonl is consistently available across all MCP-enabled workflows.
Report generated automatically by the Daily Observability Report workflow Analysis window: Last 7 days | Runs analyzed: 20
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
api.github.com
github.com
[!TIP] api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:
tools:
github:
mode: gh-proxy
See GitHub Tools for more information on gh-proxy mode.
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
Executive Summary
I reviewed a capped sample of 20 workflow runs from the last 7 days. Firewall observability is the weak spot: 18 sampled runs had firewall enabled, but only 11 included the Squid
access.log, so 7 firewall-enabled failures are missing the log needed for network debugging. MCP telemetry is present in every sampled run viarpc-messages.jsonl; 11 files contain usable JSON-RPC traffic and 9 are zero-length placeholders from early-abort runs.No run in the sample was missing both MCP telemetry files, so there are no MCP critical gaps. The main action item is to restore firewall log emission on failure paths.
Key Alerts and Anomalies
Caution
Critical issues:
access.logis missing from 7 firewall-enabled runs: §27653712017, §27653712023, §27653712058, §27653712062, §27653929599, §27653928816, §27653927895.Warning
Warnings:
rpc-messages.jsonlfiles. They are not critical because the file exists, but they are not useful for debugging: §27653712017, §27653712023, §27653712029, §27653712034, §27653712058, §27653712062, §27653929599, §27653928816, §27653927895.Coverage Summary
access.log)gateway.jsonlorrpc-messages.jsonl)Detailed Run Analysis
Firewall-Enabled Runs
Missing Firewall Logs (
access.log)MCP-Enabled Runs
All sampled MCP runs used the canonical fallback
rpc-messages.jsonl; nogateway.jsonlfile was present in this sample.Telemetry Quality Analysis
Firewall Log Quality
access.logentries analyzed: 2,567api.githubcopilot.com,gh-aw-foundry.openai.azure.com,api.anthropic.com,github.githubassets.com,api.openai.comMCP Log Quality
rpc-messages.jsonlfallbacksafeoutputs(56),serena(11),mcpscripts(4),tavily(1),agenticworkflows(1)rpc-messages.jsonlHealthy Runs Summary
access.logand the RPC payload content were missing.Recommended Actions
access.logis flushed even when the run aborts early.rpc-messages.jsonlfiles are distinguishable from successful toolless runs.gateway.jsonlis consistently available across all MCP-enabled workflows.References:
Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
api.github.comgithub.com[!TIP]
api.github.comis blocked because GitHub API access uses the built-in GitHub tools by default. Instead of addingapi.github.comtonetwork.allowed, usetools.github.mode: gh-proxyfor direct pre-authenticated GitHub CLI access without requiring network access toapi.github.com:See GitHub Tools for more information on
gh-proxymode.To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Beta Was this translation helpful? Give feedback.
All reactions