菜单
Log analysis and troubleshooting — covers CloudWatch Logs Insights queries, Kubernetes pod logs, system logs (journald, syslog), application log patterns, error correlation, and log-based metrics. Includes query templates for common investigation scenarios.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Linux system administration troubleshooting — covers process management, disk I/O analysis, memory troubleshooting, network diagnostics, SSH operations, log analysis, and performance tuning. Includes decision trees for CPU high, memory pressure, disk issues, network problems, SSH connectivity, and service failures.
AWS compute troubleshooting — covers EC2 (launch failures, instance status checks, EBS issues, networking), ECS (task placement, service events, container health), EKS (node scaling, cluster issues), and Lambda (cold starts, timeouts, concurrency, memory tuning). Includes decision trees for common failure modes.
Search the open web (DuckDuckGo) and fetch public URLs — status pages, docs, CVE data, changelogs. Provides web_search + web_fetch tools with security controls (private-IP blocking, size limits, timeouts). Use when investigation needs external internet information and you may not know the exact URL.
Local filesystem operations — read configs, tail logs, search files, list directories, inspect file metadata, and write files. Provides secure access to local operational artifacts (Terraform, CloudFormation, Kubernetes manifests, systemd units, nginx configs, application properties, log files). Includes security blocklists for sensitive files.
Kubernetes administration and troubleshooting — covers pod debugging (CrashLoopBackOff, OOMKilled, ImagePullBackOff, Pending), node issues, CNI/networking, CoreDNS, PVC/storage, HPA/VPA autoscaling, and EKS-specific patterns. Includes decision trees for common failure modes.
Read and analyze documents — PDF, DOCX, Markdown, HTML, CSV, XLSX, JSON, YAML. Provides read_document tool with no output truncation and page-range support for PDFs. Use when the user shares a document or asks to explain, summarize, or extract information from files.
| name | log-analysis |
| description | Log analysis and troubleshooting — covers CloudWatch Logs Insights queries, Kubernetes pod logs, system logs (journald, syslog), application log patterns, error correlation, and log-based metrics. Includes query templates for common investigation scenarios. |
| metadata | {"author":"agenticops","version":"1.0","domain":"observability"} |
fields @timestamp, @message
| filter @message like /(?i)(error|exception|fatal|critical)/
| sort @timestamp desc
| limit 50
kubectl logs POD -c CONTAINER --since=1h | grep -i errorjournalctl -p err --since "1 hour ago" --no-pagerkubectl logs POD --all-containers --since=1hfields @timestamp, @message, @logStream
| filter @timestamp > ago(1h)
| filter @message like /error|exception/i
| stats count() by bin(5m)
aws cloudwatch get-metric-statistics --namespace AWS/Logs --metric-name IncomingBytesfields @logStream
| stats count() as cnt by @logStream
| sort cnt desc
| limit 10
parse @message "[*] * - *" as level, module, msg
| filter level = "ERROR"
| stats count() by module
| sort count desc
fields @timestamp, @message
| filter ispresent(errorCode)
| stats count() by errorCode
| sort count desc
filter @message like /duration/
| parse @message "duration=* ms" as duration
| stats avg(duration), pct(duration, 50), pct(duration, 95), pct(duration, 99) by bin(5m)
fields @timestamp, @message
| filter @message like /REQUEST_ID/
| sort @timestamp asc
kubectl logs -f POD -c CONTAINERkubectl logs POD --previouskubectl logs -l app=NAME --all-containers --since=1hstern DEPLOYMENT -n NAMESPACE --since 1hjournalctl -b -p err --no-pagerjournalctl -u nginx --since "2 hours ago" --no-pagerdmesg -T --level=err,crit,alert,emergjournalctl -u sshd | grep -c "Failed password" (count brute force)