Log Error Scanner Skill

Hourly summary of what's blowing up in your logs. AI clusters error variants of the same root cause and surfaces the top 3-5 issues, so you do not have to scroll through 1,243 stack traces to find the 4 that matter.

The Problem

grep ERROR app.log | wc -l tells you something is wrong. It does not tell you that 847 of those errors are the same NullPointerException in one method, the next 312 are a Redis connection issue, and the remaining 84 are noise. Eyeballing logs is the bottleneck — clustering is what makes them actionable.

How It Works

1. A runtimeenv task tails the last hour of logs, filters to ERROR/FATAL, and emits the raw text
2. The log-error-scanner skill clusters by signature, ranks by frequency, and identifies trends
3. The message task delivers the digest

Setup

1. Install this skill
2. Edit the YAML to point at your log file path or log-gathering command (journalctl, kubectl logs, docker logs, AWS CloudWatch Logs Insights query, etc.)
3. Schedule for hourly

Example YAML Job

name: log-error-hourly-digest
version: 1.0.0
description: Hourly clustered summary of ERROR/FATAL log entries

notifications:
  - userNames: [intouch]
    alertOnError: true

tasks:
  - name: collect-errors
    tool: runtimeenv
    properties:
      scriptContent: |
        #!/bin/bash
        # Collect last hour of ERROR/FATAL lines from one or more log sources
        SINCE=$(date -u -d "1 hour ago" +"%Y-%m-%d %H:%M:%S")

        # File-based logs
        awk -v since="$SINCE" '$0 >= since && /(ERROR|FATAL)/' /var/log/myapp/app.log

        # Optional: also pull from journalctl
        # journalctl --since "$SINCE" -p err --no-pager

        # Optional: AWS CloudWatch
        # aws logs filter-log-events --log-group-name /myapp/prod \
        #   --start-time $(date -d "1 hour ago" +%s000) \
        #   --filter-pattern '?ERROR ?FATAL' --output text

  - name: digest
    tool: skill
    properties:
      skillName: log-error-scanner
      input: "{{collect-errors.output}}"

  - name: send
    tool: message
    properties:
      subject: "Hourly error digest"
      body: "{{digest.answer}}"
      userNames: "intouch"

Customization

• Multiple sources — chain multiple awk/journalctl/kubectl calls in the script
• Severity floor — change (ERROR|FATAL) to also include WARN if you want noise included
• Suppress on calm — only fire send when the digest reports >0 events (use a workflow tool to gate)
• Different cadence — 15 minutes for high-traffic services, daily for low-volume

Notes

• The skill is robust to multi-line stack traces — but the upstream collector should preserve them. awk with RS trickery or journalctl --no-pager handle this
• For very high-volume logs (>1MB/hour), pre-filter to the top 100 distinct lines via sort | uniq -c | sort -rn | head -100 before sending — keeps the AI prompt cheap

Cost

• AI assistant: ~$0.005 per digest with Claude Sonnet (synthesis benefits from a stronger model)
• At hourly cadence: ~$3.60/month — pay it, this saves real on-call time