Log Analyzer
Full-dimensional intelligent log analysis skill based on RAPHL (Recursive Analysis Pattern for Hierarchical Logs). Streaming processing, low memory usage, second-level analysis of 100M+ logs.
Core Capabilities
| Capability |
Description |
| Automatic Identification |
Automatically identify log types: Java App / MySQL Binlog / Nginx / Trace / Alert |
| Entity Extraction |
20+ types including IP, thread_id, trace_id, user_id, session_id, bucket, URL, table name, etc. |
| Operation Analysis |
Detection of sensitive operations such as DELETE/UPDATE/INSERT/DROP |
| Correlation Analysis |
Construction of timelines, causal chains, and operation chains |
| Intelligent Insight |
Automatically generates analysis conclusions, evidence, and recommendations |
Supported Log Types
| Type |
Identification Features |
Extracted Content |
| Java App |
ERROR/WARN + stack trace |
Exception type, stack trace, logger, time |
| MySQL Binlog |
server id、GTID、Table_map |
Table operations, thread_id, server_id, data changes |
| Nginx Access |
IP + HTTP method + status code |
Request IP, URL, status code, duration |
| Trace |
trace_id、span_id |
Trace, call relationships, duration |
| Alert |
CRITICAL/Alert |
Alert level, source, message |
| General |
General |
Time, IP, keywords |
Usage
python .opencode/skills/log-analyzer/scripts/preprocess.py <日志文件> -o ./log_analysis
Output Files
| File |
Content |
Purpose |
summary.md |
Complete analysis report |
Read first |
entities.md |
Entity details (IP, user, table name, etc.) |
Trace operation sources |
operations.md |
Operation details |
View specific operations |
insights.md |
Intelligent insight |
Problem localization and recommendations |
analysis.json |
Structured data |
Program processing |
Entity extraction list
Network/Connection category
- IP address, IP:Port, URL, MAC address
Tracking/Session category
- trace_id、span_id、request_id、session_id、thread_id
User/Permission category
- user_id、ak（access_key）、bucket
Database category
Performance/Status category
- duration, http_status, error_code
Sensitive Operation Detection
| Type |
Detection Pattern |
Risk Level |
| Data deletion |
DELETE, DROP, TRUNCATE |
HIGH |
| Data modification |
UPDATE, ALTER, MODIFY |
MEDIUM |
| Permission change |
GRANT, REVOKE, chmod |
HIGH |
| Authentication operation |
LOGIN, LOGOUT, AUTH |
MEDIUM |
Intelligent Insight Types
| Type |
Description |
| security |
Large-scale deletion/modification, permission change |
| anomaly |
High-frequency IP, operations during abnormal time periods |
| error |
Severe anomalies, error clustering |
| audit |
Operation source, user behavior |
Analysis Process
Phase 1: 日志类型识别（采样前100行）
↓
Phase 2: 全量扫描提取（流式处理）
↓
Phase 3: 关联分析（时间排序、聚合统计）
↓
Phase 4: 智能洞察（异常检测、生成结论）
↓
Phase 5: 生成报告（Markdown + JSON）
Technical Features
| Feature |
Description |
| Streaming processing |
Read line by line; a 100M file uses only a few MB of memory |
| Regex precompilation |
20+ entity patterns precompiled for fast matching |
| Single pass |
Extraction + statistics + classification completed in one pass |
| Type adaptation |
Different log types use dedicated parsers |
Notes
- Binlog does not record client IP: only server_id and thread_id; general_log must be combined to confirm the operator
- Sensitive information masking: in reports, be careful not to expose passwords or keys
- Combine multiple log sources: binlog + application logs + audit logs are required for a complete reconstruction
