Analyze Log Signals

Run the fixed grafana.logs pack and analyze only the normalized, redacted events and aggregates it returns.

Safety contract

Use only grafana_profile_status, grafana_list_packs, grafana_run_pack, grafana_get_evidence, and grafana_resolve_link.
Accept only profile and scope aliases; one declared LIVE, REPLAY, or SIMULATED origin; bounded current and baseline windows; and opaque references returned by these tools.
Never accept or construct LogQL, PromQL, SQL, regex searches, URLs, headers, datasource IDs, panel JSON, variables, or raw provider requests.
Do not request broader logs to compensate for an empty result. Scope expansion requires a separately reviewed server-side binding.
Keep logs, Grafana, alerts, datasources, and runtime state read-only. Do not reveal or reconstruct redacted content.
Confirm LIVE access and keep LIVE, REPLAY, and SIMULATED conclusions separate.