| name | logging-telemetry-audit |
| description | Audit logging, tracing, and metrics pipelines for volume waste — debug-level logging in production, unsampled traces, high-cardinality metrics explosions, duplicate log shipping, and retention without tiers. Use this skill whenever the user shares logging configs (log4j/logback/zap, OpenTelemetry, Prometheus, Datadog/Splunk settings), complains about observability costs, or wants a telemetry efficiency review. Part of Lean Agentic AI Skills; emits lean-findings.json. |
Logging & Telemetry Audit
Producer skill — the brownfield sibling of data-minimization-designer, aimed at observability pipelines specifically. Input: logger configs, collector/agent configs, ingestion stats if available. Output: lean-findings.json.
Telemetry is data nobody asked for until something breaks — which makes it the easiest place for volume to grow unbounded. Every log line is charged the full four times (produce, ship, index, store), and indexing is the expensive, energy-hungry step people forget.
Subject type: emit subject.type: "observability" in findings.
Signatures
- DEBUG/INFO in production hot paths — per-request logging at levels no one reads in steady state. High. Evidence: level configs + volume stats. Fix: WARN default with dynamic level raising (flip to DEBUG on demand during incidents — modern log frameworks support runtime level changes).
- Unsampled tracing — 100% trace sampling at scale. High. Fix: head sampling at low rates + tail sampling for errors/slow requests (keep 100% of the interesting traces, sample the boring ones).
- High-cardinality metric labels — user IDs, request IDs, or raw URLs as metric labels; series counts explode. High: each unique label combination is a stored, indexed time series. Fix: label allowlists, path templating (/users/{id}), histograms over per-entity gauges.
- Duplicate shipping — same logs to two backends "temporarily, since the migration"; agents double-collecting (sidecar + node agent). Medium-high.
- Logs as metrics — counting log lines in the backend to build dashboards that a counter metric would serve at a fraction of the volume. Medium. Fix: emit the metric, drop the log line.
- No retention tiers — everything hot/indexed for the full retention window. Medium-high. Fix: short hot window (search-speed data), archive tier for compliance; pairs with storage-lifecycle-audit.
- Verbose formats — pretty-printed JSON, stack traces on non-errors, request/response bodies logged whole. Medium. Fix: compact encoding, body logging only on error paths with size caps.
- Collector inefficiency — no batching/compression on the shipping path (OTLP/agent batch settings at defaults). Low-medium.
Honesty rules
Ingestion volumes and series counts from the user's own stats are real numbers — report them. The named trade-off on every volume cut: diagnostic blind spots — pair each reduction with its incident-time escape hatch (dynamic levels, tail sampling, on-demand capture). Never recommend sampling error signals.
Cost signal (countable)
Cost drivers: ingested GB/day, retained GB × days, and billable metric series count. All three are countable from the platform's own stats; when available, name the exact driver and observed value in cost_signal.
Not this skill's job
What product data to collect at all (data-minimization-designer), where the archive lives (storage-lifecycle-audit).
