Auth Failure Log Triage
When a user reports an auth, permission, credential, API proxy, OAuth, token, secret, 401, 403, or 503 failure, inspect live runtime evidence before proposing secret or permission changes.
Workflow
- Confirm the affected surface from the user message: tool/integration name, URL host, thread key, execution id, pod/service, and rough time window.
- Discover
vlogs if needed:
call discover vlogs
- Query likely auth failures in the last 24h, narrowing when the user gave a host, pod, thread, or execution id.
For Centaur API proxy / Iron Proxy issues:
call vlogs query '{"query":"kubernetes.pod_name:centaur-api-proxy-* AND (audit.status_code:401 OR audit.status_code:403 OR audit.status_code:503 OR \"failed to fetch secret\" OR unauthorized OR forbidden OR auth OR oauth OR token OR secret)","start":"24h","limit":100}'
For a specific thread:
call vlogs thread_trace '{"thread_key":"THREAD_KEY","start":"24h","limit":500}'
call vlogs tool_usage_by_thread '{"thread_key":"THREAD_KEY","start":"24h","limit":200}'
For a specific execution:
call vlogs execution_timeline '{"execution_id":"EXECUTION_ID"}'
- If the direct query is empty, find labels first:
call vlogs field_values '{"field":"service","query":"*proxy*","start":"24h","limit":200}'
call vlogs field_names '{"query":"service:iron-proxy","start":"24h"}'
call vlogs streams '{"query":"proxy","start":"24h"}'
- Summarize only what the logs support:
- Counts by status code:
401, 403, 503.
- Secret-resolution errors and the secret reference name, without exposing secret values.
- Timestamp, pod, service, host, method, path, and status for concrete failures.
- Whether auth transforms injected credentials, if shown by proxy fields such as
request_transforms.
- Distinguish upstream denial (
audit.status_code=403) from local proxy/secret resolution failure (failed to fetch secret).
Output Rules
- Lead with whether log evidence was found.
- Do not claim a secret or permission is wrong unless logs show that.
- Do not recommend secret rewiring until you have checked live
vlogs evidence and compared the relevant error shape.
- If no logs are found, say which query/window was checked and ask for the missing discriminator: time, thread key, execution id, host, or integration name.
1---2name: auth-failure-log-triage3description: Investigate reported auth, credential, permission, API proxy, 401, 403, 503, OAuth, token, or secret-resolution failures by querying VictoriaLogs first. Use when a user says an integration auth failed, a tool got unauthorized/forbidden/service unavailable, an api-proxy request failed, or asks why credentials/secrets are not working.4---56# Auth Failure Log Triage78When a user reports an auth, permission, credential, API proxy, OAuth, token, secret, `401`, `403`, or `503` failure, inspect live runtime evidence before proposing secret or permission changes.910## Workflow11121. Confirm the affected surface from the user message: tool/integration name, URL host, thread key, execution id, pod/service, and rough time window.132. Discover `vlogs` if needed:1415```bash16call discover vlogs17```18193. Query likely auth failures in the last 24h, narrowing when the user gave a host, pod, thread, or execution id.2021For Centaur API proxy / Iron Proxy issues:2223```bash24call vlogs query '{"query":"kubernetes.pod_name:centaur-api-proxy-* AND (audit.status_code:401 OR audit.status_code:403 OR audit.status_code:503 OR \"failed to fetch secret\" OR unauthorized OR forbidden OR auth OR oauth OR token OR secret)","start":"24h","limit":100}'25```2627For a specific thread:2829```bash30call vlogs thread_trace '{"thread_key":"THREAD_KEY","start":"24h","limit":500}'31call vlogs tool_usage_by_thread '{"thread_key":"THREAD_KEY","start":"24h","limit":200}'32```3334For a specific execution:3536```bash37call vlogs execution_timeline '{"execution_id":"EXECUTION_ID"}'38```39404. If the direct query is empty, find labels first:4142```bash43call vlogs field_values '{"field":"service","query":"*proxy*","start":"24h","limit":200}'44call vlogs field_names '{"query":"service:iron-proxy","start":"24h"}'45call vlogs streams '{"query":"proxy","start":"24h"}'46```47485. Summarize only what the logs support:4950- Counts by status code: `401`, `403`, `503`.51- Secret-resolution errors and the secret reference name, without exposing secret values.52- Timestamp, pod, service, host, method, path, and status for concrete failures.53- Whether auth transforms injected credentials, if shown by proxy fields such as `request_transforms`.54- Distinguish upstream denial (`audit.status_code=403`) from local proxy/secret resolution failure (`failed to fetch secret`).5556## Output Rules5758- Lead with whether log evidence was found.59- Do not claim a secret or permission is wrong unless logs show that.60- Do not recommend secret rewiring until you have checked live `vlogs` evidence and compared the relevant error shape.61- If no logs are found, say which query/window was checked and ask for the missing discriminator: time, thread key, execution id, host, or integration name.
paradigmxyz