detect_log_anomalies
Compare recent log windows to a baseline to flag new error signatures, rate spikes, repeated service starts, and stopped logs, with evidence and severity.
Instructions
Compare a recent window with the days before it, in the same logs.
Flags error signatures never seen in the baseline, errors whose rate jumped above the spike threshold, services that started repeatedly, and logs that stopped writing. Each finding has evidence, the threshold crossed and a reasoning sentence. Findings are marked low confidence when the logs do not reach far enough back.
Args: since: Window start (ISO or relative like 24h, counted back from the newest entry). until: Window end. Default: newest entry. baseline_days: Days before the window to compare against (1-90, default 7). source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup".
Returns:
Severity-ordered findings, counts by type and severity, baseline coverage and
the active thresholds.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | ||
| since | No | 24h | |
| until | No | ||
| device | No | ||
| source | No | ||
| baseline_days | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||