log-analyzer

# Log Analyzer ## Purpose Use this skill to extract **actionable, evidence-backed findings** from logs — not to dump filtered output. The analysis must: - detect log format before parsing, - redact PII before quoting, - distinguish *first* error from *root cause*, - separate noise from signal with statistical reasoning, - correlate across services using `trace_id` / `request_id`, - and end with a prioritised list of hypotheses + recommendations. The skill is the upstream half of incident response: it produces the **evidence package** that `incident-postmortem` formats into a blameless RCA. Use them together, in that order. ## Quick Reference | When you need to… | Jump to | |---|---| | Pick analysis depth (Lite / Standard / Strict) | §Analysis Modes | | Detect what kind of logs you are looking at | §Mandatory Gates → Gate 1 | | Avoid leaking secrets / PII in the report | §Mandatory Gates → Gate 2 | | State the time window you analysed | §Mandatory Gates → Gate 3 | | Decide whether N errors is signal or noise | §Mandatory Gates → Gate 4 | | Correlate logs across services | §Mandatory Gates → Gate 5 | | Know what NOT to call a root cause | §Mandatory Gates → Gate 6 | | Cap finding volume, route overflow to Residual Risk | §Mandatory Gates → Gate 7 | | Execute the analysis end-to-end | §Workflow | | See a complete formatted output | Load `references/example-output.md` | | Hand off to a post-mortem | §Hand-off Protocol | ## When To Use Trigger this skill when: - the user a...