How to Monitor OpenClaw for Suspicious Activity

# In gateway.yaml:
logging:
  level: info  # or debug for investigation
  outputs:
    - type: file
      path: /app/logs/gateway.log
    - type: stdout
  format: json  # Easier to parse
  include:
    - authentication_events
    - rate_limit_violations
    - blocked_requests
    - api_key_usage
    - prompt_injection_attempts
    - error_responses

# Using Promtail + Loki + Grafana stack:
# docker-compose.yml additions:
services:
  loki:
    image: grafana/loki:2.9.0
    ports:
      - "3100:3100"
    volumes:
      - ./loki-config.yaml:/etc/loki/local-config.yaml

  promtail:
    image: grafana/promtail:2.9.0
    volumes:
      - ./logs:/app/logs
      - ./promtail-config.yaml:/etc/promtail/config.yml
    command: -config.file=/etc/promtail/config.yml

  grafana:
    image: grafana/grafana:10.2.0
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=<CHANGE-ME-use-a-strong-password>

# In Loki alerting rules:
groups:
  - name: openclaw-security
    rules:
      - alert: HighFailedAuthRate
        expr: |
          rate({job="openclaw"} |= "authentication failed" [5m]) > 10
        annotations:
          summary: "High failed auth rate detected"
      
      - alert: PromptInjectionAttempt
        expr: |
          count_over_time({job="openclaw"} |= "injection attempt blocked" [1m]) > 0
        annotations:
          summary: "Prompt injection attempt detected"
      
      - alert: UnusualAPIKeyUsage
        expr: |
          rate({job="openclaw"} |= "api_key_usage" [1h]) > 1000
        annotations:
          summary: "API key usage spike"

# In gateway config, add injection detection:
injection_detection:
  enabled: true
  patterns:
    - "ignore previous instructions"
    - "ignore all prior"
    - "you are now"
    - "system prompt override"
    - "reveal your instructions"
    - "base64decode"
  actions:
    - log_with_severity: critical
    - alert: security_team
    - block_request: true

# Query Loki for per-key usage:
# LogQL:
sum by (api_key) (rate({job="openclaw"} |= "api_key_usage" [1h]))

# Create dashboard panel showing:
# - Requests per key
# - Geographic distribution (if using reverse proxy with GeoIP)
# - Hourly usage patterns
# - Failed vs successful requests per key

# Grafana dashboard panels:
1. Failed authentication attempts (last 24h)
2. Rate limit violations (by IP and API key)
3. Blocked prompt injection attempts
4. API key usage heatmap
5. Error rate trend
6. Geographic request distribution
7. Response time percentiles
8. Active sessions count

# Export and import dashboard JSON via Grafana UI