// Reads raw error logs and an alert message to figure out what broke and why. Use this skill first whenever an engineer pastes logs or says "something broke", "we have an incident", "error rate spiked", or "here are the logs". Run this BEFORE incident-brief-summarizer. Outputs a short diagnosis.
| name | log-parser |
| description | Reads raw error logs and an alert message to figure out what broke and why. Use this skill first whenever an engineer pastes logs or says "something broke", "we have an incident", "error rate spiked", or "here are the logs". Run this BEFORE incident-brief-summarizer. Outputs a short diagnosis. |
Read the logs. Find the error. Check if a deploy caused it. Output a clear diagnosis.
Look through the logs for:
Look at the timestamps:
See references/common-errors.md for what specific errors usually mean.
Write a short diagnosis in this format:
## Diagnosis
**What broke:** [one sentence — e.g., "payment-service is returning 500 errors"]
**First error at:** [timestamp]
**Error type:** [e.g., NullPointerException / DB connection refused / OOMKilled]
**Likely cause:** [e.g., "deploy at 03:01 introduced an unhandled null check"]
**Confidence:** [High / Medium / Low]
**Affected users:** [e.g., "~30% of checkout requests failing"]
**Top 3 actions:**
1. [e.g., Roll back the 03:01 deploy to payment-service]
2. [e.g., Check DB connection pool — connections may be exhausted]
3. [e.g., Page the payment-service owner if rollback doesn't help]
references/common-errors.md