Skip to main content
Glama
AIops-tools

observability-aiops

log_error_burst_rca

Read-only

Root-cause error bursts by comparing current and baseline log windows per stream, classifying new signatures, volume spikes, or single-instance bursts with cause and action.

Instructions

[READ][analysis] Root-cause an error burst: current window vs baseline, per stream.

Pulls error streams for the current window (now-hours..now) and an equal-length baseline window (now-2*hours..now-hours), then classifies each burst as a new error signature, a volume spike, or a single-instance burst — with a cause + action. If the baseline window had no logs at all (retention or ingestion gap), streams are classified no_baseline rather than new: an empty baseline is not evidence of a regression. Advisory heuristic; verify against the raw logs.

Args: selector: A Loki stream selector to scope the analysis (e.g. '{app="api"}'). hours: Window length in hours for both current and baseline (capped). loki_target: Loki target name from config; omit for the default.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
hoursNo
selectorYes
loki_targetNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.7.0

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, it discloses the window mechanics (now-hours..now vs now-2*hours..now-hours), the three classification outcomes (new signature, volume spike, single-instance burst), the no_baseline edge case and its rationale, and the advisory-heuristic caveat. This is rich behavioral context the annotations do not carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose, then structured procedure, edge-case handling, and an Args block. Every sentence carries information, though the unpacked window arithmetic is slightly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must convey what the tool returns, and it does: per-stream classifications with a cause + action, plus explicit no_baseline handling. For a 3-param analytical tool with read-only annotations, nothing material to correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage the description must compensate, and it does: selector is defined as a Loki stream selector with a concrete example, hours as the shared window length for both windows (and noted as capped), and loki_target as a config name defaulting to omit. Minor gap: the actual cap value and hour granularity are not specified, but the semantics are otherwise well covered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ('Root-cause an error burst: current window vs baseline, per stream') that clearly distinguishes it from siblings like log_volume_analysis, loki_query, and firing_alert_rca. An agent can tell what it does and how it differs without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear triggering context (root-causing an error burst) and even a caveat about verification against raw logs, but it never names alternatives such as log_volume_analysis or loki_query, nor states explicit when-not-to-use conditions. Clear context without exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.