Validate Endpoint Telemetry

Confirm local Beacon endpoint health, event writes, and runtime log state

Overview

Use endpoint validation to prove the local Beacon install can find its configuration, write endpoint events, and read the expected runtime JSONL log.

Start here when you are evaluating Beacon locally, preparing a pilot, or collecting support evidence before managed deployment.

Setup

Run validation after Beacon has installed endpoint telemetry:

Configure endpoint telemetry

beacon endpoint install
beacon endpoint status

Validation Workflow

1. Check health

   Run status and doctor checks to confirm local configuration, collector state, diagnostics, and discovered harnesses.

2. Write a validation event

   Append a known-good synthetic event so later checks have a controlled record to find.

3. Confirm the runtime log

   Verify user or system mode, runtime path, freshness, rotation behavior, and any custom log path used for testing.

Run The Validation Path

Validate local endpoint telemetry

beacon endpoint status
beacon endpoint doctor
beacon endpoint test-event
beacon endpoint status

Sample output

Sample output

$ beacon endpoint doctor

endpoint config: pass
collector config: pass
runtime log: pass
launchd service: pass
harness telemetry: pass

$ beacon endpoint test-event
checked runtime log: ok
wrote validation event: ok

View Results

The final status check should show a recent last Beacon event. If you open the dashboard, Log Search should include the synthetic validation event.

Open dashboard

beacon endpoint dashboard --open

Detailed Guides

Run Endpoint Health Checks

Validate endpoint status, doctor checks, discovered harnesses, and local collector readiness.

Write Validation Events

Write synthetic Beacon events and confirm the runtime log accepts endpoint telemetry.

Inspect Runtime Logs

Inspect runtime JSONL paths, last-event state, and user versus system mode behavior.

Troubleshooting

• If doctor fails before writing an event, fix endpoint configuration or collector health first.
• If test-event fails, check runtime log path and permissions.
• If status shows no recent event after a successful write, confirm you are checking the same user-mode, system-mode, or custom log path.