Log triage: from noise to three hypotheses

Groups a messy log into failure signatures and ranks hypotheses before anyone touches code.

Coding debugginglogsincident Verified 2026-11-03

When to use it

An incident channel has 4,000 lines of logs and no one has read them all.

The prompt

Copy into your assistant
Triage the logs below into failure signatures.

Produce:
1. Distinct failure signatures, each with its first timestamp and count.
2. The earliest signature that is not a consequence of another one.
3. Three hypotheses for the root cause, ranked, each with the log evidence for and against.
4. The one command or query that would falsify the top hypothesis fastest.

Rules:
- Do not summarise the log; group it.
- Quote exact lines as evidence, with timestamps.
- If two hypotheses are equally supported, say so instead of picking one.
- Never conclude 'human error' from logs alone.

Logs:
<logs>

What to change

Include the deploy marker if you have one — half of all triage questions are answered by 'what changed'.

Why it works

Asking for the earliest non-consequential signature is the whole prompt: it prevents the model from confidently naming the loudest error, which is usually a downstream symptom.

More coding prompts

Going deeper

More prompts

All prompts