I feel like this is a bit of a "draw the rest of the owl" problem. With a couple of terabytes of logs per day, god knows how many metric timeseries, thousands of cloud environments, thousands of repositories, hundreds of thousands of build pipelines running every day, it's not something you can just point an agent at and call it a day. Segmenting and correlating the data is _hard_. Even something as seemingly simple as "p95 latency of this endpoint has increased - what repo contains the responsible code" is difficult to do, even if you are willing to give an agent read access to everything.
suncemoje 8 hours ago [-]
> With a couple of terabytes of logs per day, god knows how many metric timeseries, thousands of cloud environments, thousands of repositories, hundreds of thousands of build pipelines running every day, it's not something you can just point an agent at and call it a day. Segmenting and correlating the data is _hard_.
In my experience, this is exactly what LLMs / a simple agentic system with one or more sub-agents and a few tools are extremely good at.
cloudrkt 13 hours ago [-]
Could a system one model like Jev not provide some sort of "pre-classification" on these logs to make this in to something workable?
jeffbee 17 hours ago [-]
Yeah something about this whole concept is way, way off. The energy, and therefore cost, of an LLM analyzing every data point of every time series is many orders of magnitude too high, unless your operations are trivial.
srdjanr 11 hours ago [-]
I don't think the idea is to give agents raw data, but for it to run many queries. Humans also don't look at terabytes of raw logs.
jubilee33 16 hours ago [-]
I encounter this problem a lot in my work. Agents being run on a cron for instance, where the task is not dynamic and a simple script can be more than sufficient. As agentic use increases i think it will get worse, as scripting is hard to do elegantly, even if the agent is writing the script.
But having an agentic call for every single detail is just so inefficient.
antupis 15 hours ago [-]
I think there running both will be winning combination scripts/classical ML do large scale crunching and when they find some anomaly or some threshold creates alert. Agents will create initial report and maybe create first pr for developer.
You can can read from Loki or Journald and use regex or alert levels to filter what you pass to the LLM.
I've been using it with deepseek for my homelab. Its pretty helpful.
suncemoje 8 hours ago [-]
> In my iteration on this, I’ve found that a pure agent loop is not the optimal shape for agentic monitors. Rather, a harness that allows the agent to write a spec of how to monitor, along with a deterministic system for running those specs, produces significantly cleaner signals with dramatically lower token usage.
Would be curious:
1. How / at what interval does it run those specs?
2. Are these basically just queries? Or what's included in a "spec" that an agent executes on?
t0mas88 15 hours ago [-]
Interesting idea. I guess the main challenge is to create some kind of harness to make the input volume appropriate for an LLM to evaluate. Billions of the same log events from a raw stream will be cost prohibitive and not find you much interesting output. But a trend in some value changing would.
As a human I look at Datadog or Grafana plus some log searches, maybe those need to become tools for the agent.
23 hours ago [-]
yegle 17 hours ago [-]
I have been doing something similar but much smaller scale: having a daily scheduled task from Antigravity to ADB connect to my phone and dump all logs and do analysis to let me know if there's any app behaving weirdly (e.g. repeated crashes).
The adb connection is intentionally over Tailscale so in the morning after I connect to some random WiFi (Android remote debugging is only enabled w/ WiFi connection) I can start reading the report, then quote and ask Gemini to fix some issues.
skyfine 17 hours ago [-]
We have been doing this recently after some security incidents. Constant monitoring of all security related events, and being able spot anomalys which our normal system isn’t able to catch. The active part is just emailing us right now, but I am considering adding some light lock down actions.
jDucky 7 hours ago [-]
[flagged]
kelseydh 18 hours ago [-]
It feels like the real value here will be from monitoring services like DataDog adding this functionality to their own internal products, rather than companies rolling their own agentic monitoring. Datadog's Bits AI is already quite helpful in scanning monitoring data for insights.
theshrike79 17 hours ago [-]
Without even knowing what it is, I'm kinda guessing Datadog's AI also has a nice hefty price tag attached to it?
Feels like the author hits the nail on the head but leaves out higher cardinality data. Would love to know how Anthropic goes about ingesting and analyzing their logs, of which they presumably have many.
appplication 22 hours ago [-]
Ingesting? Presumably Kafka. Analyzing? Presumably a fairly large analytics org.
rihegher 11 hours ago [-]
Claude code is regularly calling some datadog API
renegade-otter 16 hours ago [-]
This is like tokenmaxxing for observability?
simianwords 15 hours ago [-]
This is a thought terminating cliche.
There’s a tendency to sneer at any proposed change to how the industry works because apparently we are already at the global optimum and every new change is just marketing and hype.
It’s so obvious that we will have round the clock “intelligent” monitoring.
Token costs are getting cheaper by the month. There’s a 2x drop in prices every month or so.
It’s more useful to predict where the industry will go forward.
esafak 23 hours ago [-]
How are you setting the alerts? Are you using anomaly detection? If so, what kind?
In my experience, this is exactly what LLMs / a simple agentic system with one or more sub-agents and a few tools are extremely good at.
You can can read from Loki or Journald and use regex or alert levels to filter what you pass to the LLM.
I've been using it with deepseek for my homelab. Its pretty helpful.
Would be curious:
1. How / at what interval does it run those specs?
2. Are these basically just queries? Or what's included in a "spec" that an agent executes on?
As a human I look at Datadog or Grafana plus some log searches, maybe those need to become tools for the agent.
The adb connection is intentionally over Tailscale so in the morning after I connect to some random WiFi (Android remote debugging is only enabled w/ WiFi connection) I can start reading the report, then quote and ask Gemini to fix some issues.
And if not today, it will have one soon.
(Disclosure: Not mine, but a friend's.)
It’s so obvious that we will have round the clock “intelligent” monitoring.
Token costs are getting cheaper by the month. There’s a 2x drop in prices every month or so.
It’s more useful to predict where the industry will go forward.
I made a comment touching on similar things a while back. This is obviously the future.
Expect a lot of techno conservatives and greybeards pushing back on this.
“Just have better unit tests”
“Just have traditional alerts using SLO budgets”