Log analysis

Logs are a haystack that grows faster than you can read it. The skill is not reading logs — it is constructing a query narrow enough to answer one question, then widening only as far as needed.

The failure this prevents: scrolling. Scrolling through logs feels like work and finds only what happens to be near the cursor.

1. Ask one answerable question

Before opening anything, write the question down. "What went wrong?" is not answerable. These are:

• Did request abc-123 reach the payment service?
• How many 500s between 14:00 and 14:30, and on which endpoint?
• What is the first error after the deploy at 13:47?
• Which tenant accounts for the spike?

Done when: you have a question with a checkable answer.