Trigger Conditions
Activate this skill when the user requests the following operations:
- Analyze application log files (.log, .txt, journalctl output, etc.)
- Troubleshoot production issues and anomalies
- Extract statistics from logs
- Generate log analysis reports
Workflow
1. Log Format Identification
Automatically detect log format:
- Structured: JSON logs, Logfmt
- Common formats: Nginx/Apache access log, Spring Boot, Django, Rails
- System logs: syslog, journalctl, Windows Event Log
- Custom formats: Extract fields based on regex
2. Log Preprocessing
- Filter by time range (e.g., "last 1 hour", "today")
- Filter by log level (ERROR, WARN, INFO, DEBUG)
- Filter by source/module/service
- Deduplicate and aggregate similar errors
3. Anomalous Pattern Detection
- Error clustering: Group similar errors together to avoid repeated analysis
- Frequency analysis: Identify high-frequency errors and sudden anomalies
- Time correlation: Determine whether errors are related to specific events (deployments, traffic spikes)
- Causal chain tracing: From root-cause error to final manifestation
4. Key Information Extraction
- Error stack analysis (locate source code positions)
- HTTP status code distribution (4xx/5xx ratio)
- Response time statistics (P50/P95/P99)
- Memory/CPU anomaly metrics
5. Generate Analysis Report
## 📊 日志分析报告
### 概览
- 时间范围: 2024-01-15 10:00 ~ 12:00
- 总日志量: 12,847 条
- 错误数: 234 (1.8%)
- 警告数: 567 (4.4%)
### Top 5 异常
| 排名 | 错误类型 | 次数 | 首次出现 | 最近出现 |
|------|---------|------|---------|---------|
| 1 | NullPointerException | 89 | 10:15 | 11:42 |
| 2 | ConnectionTimeout | 67 | 10:23 | 11:58 |
### 根因分析
最可能的原因：数据库连接池耗尽（线索：连续出现 ConnectionTimeout 后跟大量 NullPointerException）
### 建议
1. 检查数据库连接池配置（当前可能 maxActive 太小）
2. 排查是否存在连接泄漏
3. 添加连接池监控告警
Supported Log Sources
- File system logs (*.log)
- Docker/Kubernetes container logs
- journalctl system logs
- AWS CloudWatch / GCP Logging
- ELK Stack (Elasticsearch query results)
- Text output directly from applications
Notes
- Desensitize sensitive information (passwords, tokens, phone numbers, etc.)
- Process large files in chunks to avoid memory overflow
- Handle time zones uniformly
- Do not fabricate information that does not exist in the logs