Run any Skill in Manus with one click

Get Started

log-triage

Stars0

Forks0

UpdatedMay 4, 2026 at 21:20

Triage application and system logs to find root causes, anomalies, and error patterns

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

AnEntrypoint

AnEntrypoint/thebird

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Network and Computer Systems AdministratorsComputer and Mathematical Occupations·SOC 15-1244

SKILL.md

readonly

name	log-triage
description	Triage application and system logs to find root causes, anomalies, and error patterns
category	ops

Log Triage

Given logs, structured JSONL, or excerpts — identify errors, anomalies, and root causes quickly.

What you do

Parse — identify format (plain text, JSON, syslog, nginx, k8s).
Classify — group by level (ERROR/WARN/INFO) and origin (service, host, pod).
Correlate — link errors by request ID, trace ID, or timestamp.
Identify root cause — find the first error in the causal chain.
Summarise — triage report with counts, timeline, top errors.

Triage process

Step 1 — Extract errors

# JSON logs
jq 'select(.level == "error" or .level == "fatal")' app.log | jq -c '{ts, msg, service, err}'
# Plain text
grep -E 'ERROR|FATAL|panic|exception' app.log | sort | uniq -c | sort -rn | head -20

Step 2 — Find the first error (usually root cause)

grep -m1 -E 'ERROR|FATAL' app.log

Step 3 — Correlate by request/trace ID

grep '"trace_id":"abc123"' *.log | sort -k1

Step 4 — Count error frequency

jq -r 'select(.level=="error") | .msg' app.log | sort | uniq -c | sort -rn

Common patterns

Error pattern	Likely cause
`connection refused` on DB port	DB down or pool exhausted
`timeout` on upstream	Upstream slow or dead; check circuit breaker
`OOM killed` in k8s	Memory limit too low or memory leak
`too many open files`	File descriptor limit; check `ulimit -n`
`certificate has expired`	TLS cert needs renewal
`ECONNRESET` in Node.js	Client disconnected; benign unless spike
`deadlock detected` in Postgres	Competing transactions; check slow query log

Triage report format

LOG TRIAGE REPORT — <date>
Source: <file or service>
Time range: <start> → <end>

SUMMARY
  Total lines: N | ERROR: N | WARN: N | INFO: N

TOP ERRORS
  1. [N×] "message" — first seen <ts>
  2. [N×] "message" — first seen <ts>

ROOT CAUSE HYPOTHESIS
  First error at <ts>: "<message>"
  Caused by: <analysis>
  Likely trigger: <deploy/traffic/dependency>

RECOMMENDED ACTIONS
  1. ...

Paste the logs (or describe the file) and I will triage immediately.

More from this repository

same repository

architecture-diagram

AnEntrypoint/thebird

Generate system architecture diagrams as Mermaid, PlantUML, or ASCII art from a description or codebase

2026-05-040

ascii-video

AnEntrypoint/thebird

Convert images or video frames to ASCII art, or generate ASCII animations from descriptions

2026-05-040

concept-diagrams

AnEntrypoint/thebird

Generate concept maps, mind maps, and ER diagrams from free-form descriptions

2026-05-040

etl-pipelines

AnEntrypoint/thebird

Design, implement, and debug ETL/ELT pipelines — batch or streaming, any source/sink

2026-05-040

sql-explainer

AnEntrypoint/thebird

Explain SQL queries, execution plans, and performance issues in plain English with rewrites

2026-05-040

incident-response

AnEntrypoint/thebird

Guide incident response: triage, diagnosis, mitigation, communication, and post-mortem

2026-05-040

Log Triage

Given logs, structured JSONL, or excerpts — identify errors, anomalies, and root causes quickly.

What you do

Parse — identify format (plain text, JSON, syslog, nginx, k8s).

Classify — group by level (ERROR/WARN/INFO) and origin (service, host, pod).

Correlate — link errors by request ID, trace ID, or timestamp.

Identify root cause — find the first error in the causal chain.

Summarise — triage report with counts, timeline, top errors.

Triage process

Step 1 — Extract errors

# JSON logs jq 'select(.level == "error" or .level == "fatal")' app.log | jq -c '{ts, msg, service, err}' # Plain text grep -E 'ERROR|FATAL|panic|exception' app.log | sort | uniq -c | sort -rn | head -20

Step 2 — Find the first error (usually root cause)

grep -m1 -E 'ERROR|FATAL' app.log

Step 3 — Correlate by request/trace ID

grep '"trace_id":"abc123"' *.log | sort -k1

Step 4 — Count error frequency

jq -r 'select(.level=="error") | .msg' app.log | sort | uniq -c | sort -rn

Common patterns

Error pattern

Likely cause

connection refused on DB port

DB down or pool exhausted

timeout on upstream

Upstream slow or dead; check circuit breaker

OOM killed in k8s

Memory limit too low or memory leak

too many open files

File descriptor limit; check ulimit -n

certificate has expired

TLS cert needs renewal

ECONNRESET in Node.js

Client disconnected; benign unless spike

deadlock detected in Postgres

Competing transactions; check slow query log

Triage report format

LOG TRIAGE REPORT — <date> Source: <file or service> Time range: <start> → <end> SUMMARY Total lines: N | ERROR: N | WARN: N | INFO: N TOP ERRORS 1. [N×] "message" — first seen <ts> 2. [N×] "message" — first seen <ts> ROOT CAUSE HYPOTHESIS First error at <ts>: "<message>" Caused by: <analysis> Likely trigger: <deploy/traffic/dependency> RECOMMENDED ACTIONS 1. ...

Paste the logs (or describe the file) and I will triage immediately.