一键在 Manus 中运行任何 Skill

开始使用

log-triage

星标0

分支0

更新时间2026年5月4日 21:20

Triage application and system logs to find root causes, anomalies, and error patterns

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

AnEntrypoint

AnEntrypoint/thebird

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Log Triage

Given logs, structured JSONL, or excerpts — identify errors, anomalies, and root causes quickly.

What you do

Parse — identify format (plain text, JSON, syslog, nginx, k8s).
Classify — group by level (ERROR/WARN/INFO) and origin (service, host, pod).
Correlate — link errors by request ID, trace ID, or timestamp.
Identify root cause — find the first error in the causal chain.
Summarise — triage report with counts, timeline, top errors.

Triage process

Step 1 — Extract errors

# JSON logs
jq 'select(.level == "error" or .level == "fatal")' app.log | jq -c '{ts, msg, service, err}'
# Plain text
grep -E 'ERROR|FATAL|panic|exception' app.log | sort | uniq -c | sort -rn | head -20

Step 2 — Find the first error (usually root cause)

grep -m1 -E 'ERROR|FATAL' app.log

Step 3 — Correlate by request/trace ID

grep '"trace_id":"abc123"' *.log | sort -k1

Step 4 — Count error frequency

jq -r 'select(.level=="error") | .msg' app.log | sort | uniq -c | sort -rn

Common patterns

Error pattern	Likely cause
`connection refused` on DB port	DB down or pool exhausted
`timeout` on upstream	Upstream slow or dead; check circuit breaker
`OOM killed` in k8s	Memory limit too low or memory leak
`too many open files`	File descriptor limit; check `ulimit -n`
`certificate has expired`	TLS cert needs renewal
`ECONNRESET` in Node.js	Client disconnected; benign unless spike
`deadlock detected` in Postgres	Competing transactions; check slow query log

Triage report format

LOG TRIAGE REPORT — <date>
Source: <file or service>
Time range: <start> → <end>

SUMMARY
  Total lines: N | ERROR: N | WARN: N | INFO: N

TOP ERRORS
  1. [N×] "message" — first seen <ts>
  2. [N×] "message" — first seen <ts>

ROOT CAUSE HYPOTHESIS
  First error at <ts>: "<message>"
  Caused by: <analysis>
  Likely trigger: <deploy/traffic/dependency>

RECOMMENDED ACTIONS
  1. ...

Paste the logs (or describe the file) and I will triage immediately.

同仓库更多 Skills

同仓库

architecture-diagram

AnEntrypoint/thebird

Generate system architecture diagrams as Mermaid, PlantUML, or ASCII art from a description or codebase

2026-05-040

ascii-video

AnEntrypoint/thebird

Convert images or video frames to ASCII art, or generate ASCII animations from descriptions

2026-05-040

concept-diagrams

AnEntrypoint/thebird

Generate concept maps, mind maps, and ER diagrams from free-form descriptions

2026-05-040

etl-pipelines

AnEntrypoint/thebird

Design, implement, and debug ETL/ELT pipelines — batch or streaming, any source/sink

2026-05-040

sql-explainer

AnEntrypoint/thebird

Explain SQL queries, execution plans, and performance issues in plain English with rewrites

2026-05-040

incident-response

AnEntrypoint/thebird

Guide incident response: triage, diagnosis, mitigation, communication, and post-mortem

2026-05-040

Log Triage

Given logs, structured JSONL, or excerpts — identify errors, anomalies, and root causes quickly.

What you do

Parse — identify format (plain text, JSON, syslog, nginx, k8s).

Classify — group by level (ERROR/WARN/INFO) and origin (service, host, pod).

Correlate — link errors by request ID, trace ID, or timestamp.

Identify root cause — find the first error in the causal chain.

Summarise — triage report with counts, timeline, top errors.

Triage process

Step 1 — Extract errors

# JSON logs jq 'select(.level == "error" or .level == "fatal")' app.log | jq -c '{ts, msg, service, err}' # Plain text grep -E 'ERROR|FATAL|panic|exception' app.log | sort | uniq -c | sort -rn | head -20

Step 2 — Find the first error (usually root cause)

grep -m1 -E 'ERROR|FATAL' app.log

Step 3 — Correlate by request/trace ID

grep '"trace_id":"abc123"' *.log | sort -k1

Step 4 — Count error frequency

jq -r 'select(.level=="error") | .msg' app.log | sort | uniq -c | sort -rn

Common patterns

Error pattern

Likely cause

connection refused on DB port

DB down or pool exhausted

timeout on upstream

Upstream slow or dead; check circuit breaker

OOM killed in k8s

Memory limit too low or memory leak

too many open files

File descriptor limit; check ulimit -n

certificate has expired

TLS cert needs renewal

ECONNRESET in Node.js

Client disconnected; benign unless spike

deadlock detected in Postgres

Competing transactions; check slow query log

Triage report format

LOG TRIAGE REPORT — <date> Source: <file or service> Time range: <start> → <end> SUMMARY Total lines: N | ERROR: N | WARN: N | INFO: N TOP ERRORS 1. [N×] "message" — first seen <ts> 2. [N×] "message" — first seen <ts> ROOT CAUSE HYPOTHESIS First error at <ts>: "<message>" Caused by: <analysis> Likely trigger: <deploy/traffic/dependency> RECOMMENDED ACTIONS 1. ...

Paste the logs (or describe the file) and I will triage immediately.

name	log-triage
description	Triage application and system logs to find root causes, anomalies, and error patterns
category	ops