Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

Commencer

log-triage

Étoiles0

Forks0

Mis à jour4 mai 2026 à 21:20

Triage application and system logs to find root causes, anomalies, and error patterns

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

AnEntrypoint

AnEntrypoint/thebird

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Administrateurs de réseaux et de systèmes informatiquesProfessions informatiques et mathématiques·SOC 15-1244

SKILL.md

readonly

name	log-triage
description	Triage application and system logs to find root causes, anomalies, and error patterns
category	ops

Log Triage

Given logs, structured JSONL, or excerpts — identify errors, anomalies, and root causes quickly.

What you do

Parse — identify format (plain text, JSON, syslog, nginx, k8s).
Classify — group by level (ERROR/WARN/INFO) and origin (service, host, pod).
Correlate — link errors by request ID, trace ID, or timestamp.
Identify root cause — find the first error in the causal chain.
Summarise — triage report with counts, timeline, top errors.

Triage process

Step 1 — Extract errors

# JSON logs
jq 'select(.level == "error" or .level == "fatal")' app.log | jq -c '{ts, msg, service, err}'
# Plain text
grep -E 'ERROR|FATAL|panic|exception' app.log | sort | uniq -c | sort -rn | head -20

Step 2 — Find the first error (usually root cause)

grep -m1 -E 'ERROR|FATAL' app.log

Step 3 — Correlate by request/trace ID

grep '"trace_id":"abc123"' *.log | sort -k1

Step 4 — Count error frequency

jq -r 'select(.level=="error") | .msg' app.log | sort | uniq -c | sort -rn

Common patterns

Error pattern	Likely cause
`connection refused` on DB port	DB down or pool exhausted
`timeout` on upstream	Upstream slow or dead; check circuit breaker
`OOM killed` in k8s	Memory limit too low or memory leak
`too many open files`	File descriptor limit; check `ulimit -n`
`certificate has expired`	TLS cert needs renewal
`ECONNRESET` in Node.js	Client disconnected; benign unless spike
`deadlock detected` in Postgres	Competing transactions; check slow query log

Triage report format

LOG TRIAGE REPORT — <date>
Source: <file or service>
Time range: <start> → <end>

SUMMARY
  Total lines: N | ERROR: N | WARN: N | INFO: N

TOP ERRORS
  1. [N×] "message" — first seen <ts>
  2. [N×] "message" — first seen <ts>

ROOT CAUSE HYPOTHESIS
  First error at <ts>: "<message>"
  Caused by: <analysis>
  Likely trigger: <deploy/traffic/dependency>

RECOMMENDED ACTIONS
  1. ...

Paste the logs (or describe the file) and I will triage immediately.

Plus depuis ce dépôt

même dépôt

architecture-diagram

AnEntrypoint/thebird

Generate system architecture diagrams as Mermaid, PlantUML, or ASCII art from a description or codebase

2026-05-040

ascii-video

AnEntrypoint/thebird

Convert images or video frames to ASCII art, or generate ASCII animations from descriptions

2026-05-040

concept-diagrams

AnEntrypoint/thebird

Generate concept maps, mind maps, and ER diagrams from free-form descriptions

2026-05-040

etl-pipelines

AnEntrypoint/thebird

Design, implement, and debug ETL/ELT pipelines — batch or streaming, any source/sink

2026-05-040

sql-explainer

AnEntrypoint/thebird

Explain SQL queries, execution plans, and performance issues in plain English with rewrites

2026-05-040

incident-response

AnEntrypoint/thebird

Guide incident response: triage, diagnosis, mitigation, communication, and post-mortem

2026-05-040

Log Triage

Given logs, structured JSONL, or excerpts — identify errors, anomalies, and root causes quickly.

What you do

Parse — identify format (plain text, JSON, syslog, nginx, k8s).

Classify — group by level (ERROR/WARN/INFO) and origin (service, host, pod).

Correlate — link errors by request ID, trace ID, or timestamp.

Identify root cause — find the first error in the causal chain.

Summarise — triage report with counts, timeline, top errors.

Triage process

Step 1 — Extract errors

# JSON logs jq 'select(.level == "error" or .level == "fatal")' app.log | jq -c '{ts, msg, service, err}' # Plain text grep -E 'ERROR|FATAL|panic|exception' app.log | sort | uniq -c | sort -rn | head -20

Step 2 — Find the first error (usually root cause)

grep -m1 -E 'ERROR|FATAL' app.log

Step 3 — Correlate by request/trace ID

grep '"trace_id":"abc123"' *.log | sort -k1

Step 4 — Count error frequency

jq -r 'select(.level=="error") | .msg' app.log | sort | uniq -c | sort -rn

Common patterns

Error pattern

Likely cause

connection refused on DB port

DB down or pool exhausted

timeout on upstream

Upstream slow or dead; check circuit breaker

OOM killed in k8s

Memory limit too low or memory leak

too many open files

File descriptor limit; check ulimit -n

certificate has expired

TLS cert needs renewal

ECONNRESET in Node.js

Client disconnected; benign unless spike

deadlock detected in Postgres

Competing transactions; check slow query log

Triage report format

LOG TRIAGE REPORT — <date> Source: <file or service> Time range: <start> → <end> SUMMARY Total lines: N | ERROR: N | WARN: N | INFO: N TOP ERRORS 1. [N×] "message" — first seen <ts> 2. [N×] "message" — first seen <ts> ROOT CAUSE HYPOTHESIS First error at <ts>: "<message>" Caused by: <analysis> Likely trigger: <deploy/traffic/dependency> RECOMMENDED ACTIONS 1. ...

Paste the logs (or describe the file) and I will triage immediately.