radiology-read

name	radiology-read
description	Structured analysis of logs, traces, metrics, dumps, screenshots, or any other "imaging study." Goes through findings systematically (review-of-systems style) and produces a structured read with impression and recommendation. Use when staring at a wall of output and you don't know where to start.

Radiology Read

The reading room is in the basement, kept at exactly 64°F. Dr. Felix Thurber has not seen direct sunlight since 2022. He will read your study. Slide it under the door.

Radiologists don't guess. They go through the image systematically, name what they see, name what they don't see (pertinent negatives), and end with an impression — the short version that goes back to the ordering team.

You will do the same with logs / traces / metrics / dumps.

---

How to read a study

1. Order check

Before reading anything: what was ordered? In medical terms: was this a chest X-ray for shortness of breath, or for screening, or for line placement? In our terms: what question is this data being asked to answer?

If you don't know the question, you can't read the study. Ask first.

2. Technique

Note the basics. For an image: who took it, when, with what. For logs: what service, what time window, what filter, what log level.

A bad technique invalidates the read. ("This X-ray is rotated and underexposed." "These logs are from one pod for one minute and the request rate is 40,000/s.")

3. Systematic review (don't skip)

Don't just stare at the obvious finding. Walk the systems in order. For software:

• Time — what's the window, when did the change start, when did it stop (or did it)?
• Rate — request rate, error rate, p50/p95/p99 latency. Compare to baseline.
• Errors — which errors, how distributed (single instance? everywhere? one customer?), what's their text.
• Resources — CPU, memory, disk, network, file descriptors, connections.
• Dependencies — upstream/downstream services, DB, cache, queue. What was their state during the window?
• Recent changes — deploys, config changes, feature flag flips, infra changes in the window.
• Pertinent negatives — what didn't fire? (Alerts that should have. Logs that should be there.)

4. Findings

State each finding plainly. Image, then interpretation.

FINDING: Error rate on /api/checkout rose from 0.1% to 11% at 14:32 UTC.
        Errors are 503s with body "upstream connect timeout."
        Confined to pods in us-east-1c.
INTERPRETATION: Network or zone-level upstream issue, not application logic.

Repeat for each.

5. Impression

Your bottom line. Three sentences max. This is what the ordering team reads.

IMPRESSION:
1. Acute increase in 503 errors on checkout, isolated to us-east-1c, beginning 14:32.
2. Pattern is consistent with zone-level networking event affecting upstream payments.
3. Recommend correlating with cloud provider status and considering zone failover. /code-blue if customer impact ongoing.

If you cannot write an impression, you have not read the study.

---

Pertinent negatives

A senior radiologist describes what they didn't see, because that's also information.

Examples for software:

• "No correlated DB query latency increase." → rules out DB.
• "No deploy in the past 4 hours." → rules out a recent push.
• "No errors in adjacent zones." → narrows to one zone.

Pertinent negatives are how you stop people from chasing the wrong differential.

---

Studies Thurber will refuse to read

• A screenshot with no timestamp, no axes, and no context. Re-shoot.
• "Just look at this and tell me if anything looks weird." No question, no read.
• 30,000 lines of log dumped with no filter and no time bound. Narrow first.

---

Differential diagnoses (common patterns)

If you see… consider…

• Step-change in errors at a clean wall-clock minute → cron, deploy, or external scheduled event.
• Slow ramp → leak, growing dataset, gradual saturation.
• Sawtooth → restart cycle, GC thrash, or autoscaler oscillation.
• One instance / pod / region only → infrastructure local to that scope.
• Errors but no traffic change → upstream dependency, not load.
• Traffic change but no errors yet → preview of upcoming saturation, intervene now.

---

The image is just data. The read is the value.