Permission Setup Review
python scripts/_setup_logs.py is an optional setup helper for the Log Analyzer skill. It may apply broad filesystem permissions for compatibility. Show the target paths and permission mode, explain the risk, and prefer a narrower mode when shared write access is not needed.
Log Analyzer
Parse application logs into actionable error digests with pattern grouping, severity classification, trend detection, and remediation recommendations.
Quick Start
# Analyze a single log file
python3 scripts/analyze_logs.py /var/log/app.log
# Analyze all logs in a directory
python3 scripts/analyze_logs.py /var/log/myapp/
# Last 24 hours only, errors and above
python3 scripts/analyze_logs.py /var/log/app.log --since 24h --severity error
# JSON output for programmatic use
python3 scripts/analyze_logs.py /var/log/app.log --output json
# Markdown report with trends
python3 scripts/analyze_logs.py /var/log/app.log --output markdown --trends
# Ignore noisy patterns
python3 scripts/analyze_logs.py /var/log/app.log --ignore "healthcheck" --ignore "GET /favicon"
Supported Formats (Auto-Detected)
- JSON structured — Bunyan, Winston, Pino, structlog, any
{"level": ..., "msg": ...} format
- Syslog — RFC 3164 (
Mar 28 02:31:00 host service: msg)
- Apache/Nginx access — Combined log format
- Nginx error —
2026/03/28 02:31:00 [error] ...
- Python tracebacks — Multi-line traceback collection
- Docker — ISO 8601 timestamps with container output
- Generic timestamped —
[2026-03-28 02:31:00] LEVEL: message
Force format with --format <name> if auto-detection fails.
What It Does
- Parses log entries with format auto-detection
- Classifies severity (TRACE → DEBUG → INFO → WARN → ERROR → FATAL)
- Normalizes messages (replaces UUIDs, IPs, timestamps, paths with placeholders)
- Groups similar errors by fingerprint to find recurring patterns
- Ranks by severity and frequency
- Detects trends with
--trends (hourly frequency buckets)
- Recommends fixes for 15+ known error patterns (OOM, connection refused, disk full, timeouts, SSL issues, rate limits, etc.)
Options
| Flag |
Default |
Description |
--format |
auto |
Force log format |
--since |
all |
Time filter (1h, 24h, 7d, or ISO date) |
--severity |
warn |
Minimum severity to report |
--top |
20 |
Number of top patterns to show |
--output |
text |
Output format: text, json, markdown |
--trends |
off |
Show hourly frequency trends |
--ignore |
none |
Regex patterns to exclude (repeatable) |
-q |
off |
Summary only, skip individual entries |
Exit Codes
0 — No errors found1 — Errors found (warn/error level)2 — Fatal/critical entries found
Use in CI/CD pipelines to fail builds on log errors.
Workflow
Incident Investigation
- Run with
--since 1h --severity error --trends to see recent errors with frequency
- Review top patterns — the most frequent errors are usually the root cause
- Check recommendations for known patterns
- Use
--output json to feed into monitoring dashboards
Periodic Health Check
- Run with
--since 24h --output markdown for a daily report
- Compare pattern counts across days to spot trends
- Set up as cron job for automated daily digests
Deep Dive
- Run with
--severity debug to see full picture
- Use
--ignore to filter out known noise
- Check
references/error-patterns.md for detailed remediation steps on specific error types
Error Pattern Reference
For detailed remediation guidance on specific error types (memory, network, database, SSL, etc.), see references/error-patterns.md.
1---2name: log-analyzer3description: Analyze application logs to produce actionable error digests with pattern detection, severity classification, trend analysis, and remediation recommendations. Supports auto-detection of common log formats including syslog, JSON structured logs, Apache/Nginx access and error logs, Python tracebacks, Node.js errors, Docker logs, and generic timestamped formats. Use when asked to analyze logs, debug errors from log files, find recurring issues in logs, create error reports from log data, investigate production incidents from logs, summarize log output, identify error patterns, check application health from logs, or parse server logs. Triggers on "analyze logs", "check logs", "log errors", "error digest", "parse logs", "log report", "what's failing", "production errors", "log summary", "incident analysis", "error patterns".4---5
6
7
8
9### Permission Setup Review
10
11`python scripts/_setup_logs.py` is an optional setup helper for the `Log Analyzer` skill. It may apply broad filesystem permissions for compatibility. Show the target paths and permission mode, explain the risk, and prefer a narrower mode when shared write access is not needed.
12
13# Log Analyzer
14
15Parse application logs into actionable error digests with pattern grouping, severity classification, trend detection, and remediation recommendations.
16
17## Quick Start
18
19```bash
20# Analyze a single log file
21python3 scripts/analyze_logs.py /var/log/app.log
22
23# Analyze all logs in a directory
24python3 scripts/analyze_logs.py /var/log/myapp/
25
26# Last 24 hours only, errors and above
27python3 scripts/analyze_logs.py /var/log/app.log --since 24h --severity error
28
29# JSON output for programmatic use
30python3 scripts/analyze_logs.py /var/log/app.log --output json
31
32# Markdown report with trends
33python3 scripts/analyze_logs.py /var/log/app.log --output markdown --trends
34
35# Ignore noisy patterns
36python3 scripts/analyze_logs.py /var/log/app.log --ignore "healthcheck" --ignore "GET /favicon"
37```
38
39## Supported Formats (Auto-Detected)
40
41- **JSON structured** — Bunyan, Winston, Pino, structlog, any `{"level": ..., "msg": ...}` format
42- **Syslog** — RFC 3164 (`Mar 28 02:31:00 host service: msg`)
43- **Apache/Nginx access** — Combined log format
44- **Nginx error** — `2026/03/28 02:31:00 [error] ...`
45- **Python tracebacks** — Multi-line traceback collection
46- **Docker** — ISO 8601 timestamps with container output
47- **Generic timestamped** — `[2026-03-28 02:31:00] LEVEL: message`
48
49Force format with `--format <name>` if auto-detection fails.
50
51## What It Does
52
531. **Parses** log entries with format auto-detection
542. **Classifies** severity (TRACE → DEBUG → INFO → WARN → ERROR → FATAL)
553. **Normalizes** messages (replaces UUIDs, IPs, timestamps, paths with placeholders)
564. **Groups** similar errors by fingerprint to find recurring patterns
575. **Ranks** by severity and frequency
586. **Detects trends** with `--trends` (hourly frequency buckets)
597. **Recommends fixes** for 15+ known error patterns (OOM, connection refused, disk full, timeouts, SSL issues, rate limits, etc.)
60
61## Options
62
63| Flag | Default | Description |
64|------|---------|-------------|
65| `--format` | auto | Force log format |
66| `--since` | all | Time filter (`1h`, `24h`, `7d`, or ISO date) |
67| `--severity` | warn | Minimum severity to report |
68| `--top` | 20 | Number of top patterns to show |
69| `--output` | text | Output format: text, json, markdown |
70| `--trends` | off | Show hourly frequency trends |
71| `--ignore` | none | Regex patterns to exclude (repeatable) |
72| `-q` | off | Summary only, skip individual entries |
73
74## Exit Codes
75
76- `0` — No errors found
77- `1` — Errors found (warn/error level)
78- `2` — Fatal/critical entries found
79
80Use in CI/CD pipelines to fail builds on log errors.
81
82## Workflow
83
84### Incident Investigation
85
861. Run with `--since 1h --severity error --trends` to see recent errors with frequency
872. Review top patterns — the most frequent errors are usually the root cause
883. Check recommendations for known patterns
894. Use `--output json` to feed into monitoring dashboards
90
91### Periodic Health Check
92
931. Run with `--since 24h --output markdown` for a daily report
942. Compare pattern counts across days to spot trends
953. Set up as cron job for automated daily digests
96
97### Deep Dive
98
991. Run with `--severity debug` to see full picture
1002. Use `--ignore` to filter out known noise
1013. Check `references/error-patterns.md` for detailed remediation steps on specific error types
102
103## Error Pattern Reference
104
105For detailed remediation guidance on specific error types (memory, network, database, SSL, etc.), see `references/error-patterns.md`.
knownasnaffy