log-analyzer
全维度日志分析技能。自动识别日志类型（Java应用/MySQL Binlog/Nginx/Trace/告警），提取关键实体（IP、threadid、traceid、用户、表名等），进行根因定位、告警分析、异常洞察。支持100M+大文件。触发词：分析日志、日志排查、根因定位、告警分析、异常分析。
- Installs
- 90
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/zrt-ai-lab/opencode-skills --skill log-analyzer- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads log-analyzer automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
日志分析器
基于 RAPHL（Recursive Analysis Pattern for Hierarchical Logs）的全维度智能日志分析技能。流式处理，内存占用低，100M+ 日志秒级分析。
核心能力
| 能力 | 说明 |
|---|---|
| 自动识别 | 自动识别日志类型：Java App / MySQL Binlog / Nginx / Trace / Alert |
| 实体提取 | IP、thread_id、trace_id、user_id、session_id、bucket、URL、表名等 20+ 种 |
| 操作分析 | DELETE/UPDATE/INSERT/DROP 等敏感操作检测 |
| 关联分析 | 时间线、因果链、操作链构建 |
| 智能洞察 | 自动生成分析结论、证据、建议 |
支持的日志类型
| 类型 | 识别特征 | 提取内容 |
|---|---|---|
| Java App | ERROR/WARN + 堆栈 | 异常类型、堆栈、logger、时间 |
| MySQL Binlog | server id、GTID、Table_map | 表操作、thread_id、server_id、数据变更 |
| Nginx Access | IP + HTTP 方法 + 状态码 | 请求IP、URL、状态码、耗时 |
| Trace | trace_id、span_id | 链路追踪、调用关系、耗时 |
| Alert | CRITICAL/告警 | 告警级别、来源、消息 |
| General | 通用 | 时间、IP、关键词 |
使用方法
python .opencode/skills/log-analyzer/scripts/preprocess.py <日志文件> -o ./log_analysis
输出文件
| 文件 | 内容 | 用途 |
|---|---|---|
summary.md | 完整分析报告 | 优先阅读 |
entities.md | 实体详情（IP、用户、表名等） | 追溯操作来源 |
operations.md | 操作详情 | 查看具体操作 |
insights.md | 智能洞察 | 问题定位和建议 |
analysis.json | 结构化数据 | 程序处理 |
实体提取清单
网络/连接类
- IP 地址、IP:Port、URL、MAC 地址
追踪/会话类
- trace_id、span_id、request_id、session_id、thread_id
用户/权限类
- user_id、ak（access_key）、bucket
数据库类
- database.table、server_id
性能/状态类
- duration（耗时）、http_status、error_code
敏感操作检测
| 类型 | 检测模式 | 风险级别 |
|---|---|---|
| 数据删除 | DELETE, DROP, TRUNCATE | HIGH |
| 数据修改 | UPDATE, ALTER, MODIFY | MEDIUM |
| 权限变更 | GRANT, REVOKE, chmod | HIGH |
| 认证操作 | LOGIN, LOGOUT, AUTH | MEDIUM |
智能洞察类型
| 类型 | 说明 |
|---|---|
| security | 大批量删除/修改、权限变更 |
| anomaly | 高频 IP、异常时间段操作 |
| error | 严重异常、错误聚类 |
| audit | 操作来源、用户行为 |
分析流程
Phase 1: 日志类型识别（采样前100行）
↓
Phase 2: 全量扫描提取（流式处理）
↓
Phase 3: 关联分析（时间排序、聚合统计）
↓
Phase 4: 智能洞察（异常检测、生成结论）
↓
Phase 5: 生成报告（Markdown + JSON）
技术特点
| 特点 | 说明 |
|---|---|
| 流式处理 | 逐行读取，100M 文件只占几 MB 内存 |
| 正则预编译 | 20+ 种实体模式预编译，匹配快 |
| 一次遍历 | 提取 + 统计 + 分类一次完成 |
| 类型适配 | 不同日志类型用专用解析器 |
注意事项
- Binlog 不记录客户端 IP：只有 server_id 和 thread_id，需结合 general_log 确认操作者
- 敏感信息脱敏：报告中注意不要暴露密码、密钥
- 结合多源日志：binlog + 应用日志 + 审计日志 才能完整还原
FAQ
What does the log-analyzer skill do?
全维度日志分析技能。自动识别日志类型（Java应用/MySQL Binlog/Nginx/Trace/告警），提取关键实体（IP、threadid、traceid、用户、表名等），进行根因定位、告警分析、异常洞察。支持100M+大文件。触发词：分析日志、日志排查、根因定位、告警分析、异常分析。
How do I install log-analyzer?
Run npx skills add https://github.com/zrt-ai-lab/opencode-skills --skill log-analyzer in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/log-analyzer/ (personal) or .claude/skills/log-analyzer/ (project).
Which AI agents can use log-analyzer?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is log-analyzer safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains log-analyzer?
It is published by zrt-ai-lab in zrt-ai-lab/opencode-skills. It has 90 recorded installs.
More from zrt-ai-lab/opencode-skills
auto-douyin
zrt-ai-lab/opencode-skills
抖音视频自动发布技能。当用户需要发布视频到抖音时使用这个技能。技能包含：获取登录Cookie、上传视频、设置标题话题、定时发布等功能。
videocut-clip
zrt-ai-lab/opencode-skills
Open the skill to read its SKILL.md instructions.
auto-weixin-video
zrt-ai-lab/opencode-skills
Open the skill to read its SKILL.md instructions.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.