Buddy Self-Evolving Log Analyzer

Problem

Production log triage often gets stuck on two issues: ERROR, WARN, stack traces, and timeout messages are mixed together, making it hard to judge severity; and keyword search alone does not provide a structured view of P0/P1 events, historical trends, or alerting actions. This skill separates log analysis into two layers: deterministic rules first, optional AI reasoning second.

How it works

The workflow is rule-first and AI-enhanced:
- Severity classification: It identifies severe issues by P0/P1 rules, including ERROR/CRITICAL/FATAL, OOM, connection refused, HTTP 4xx/5xx, Traceback, WARN/WARNING, timeout, Slow query, retries, and deprecated warnings.
- Optional AI reasoning: After rule hits, an LLM can add context and root-cause interpretation. AI can be disabled to use the rule engine only, or a model can be specified.
- Flexible analysis modes: It supports basic analysis, inspecting the last N lines, keyword filtering, multiple output formats, real-time monitoring similar to tail -f, alert report generation, webhook alerts, and batch analysis across directories.
- Self-evolving memory: Historical analysis records are retained to help surface recurring errors, slow queries, or degradation patterns.

Security handling is also explicit: relative paths are constrained to the current working directory, symbolic links are rejected, webhooks block internal addresses to reduce SSRF risk, HTML output is escaped to reduce XSS risk, and alert files are written atomically for multi-process safety.