nainishshafinainishshafi/developer-productivity-skills/.github/skills/remote-pod-log-analyzer/SKILL.md

remote-pod-log-analyzer

Skill1 starsChanged 5 days agoMITView on GitHub

Analyzes remote Linux host and Kubernetes pod/container logs using SSH, kubectl, journalctl, grep, awk, sed, ripgrep, and jq. Troubleshoots CrashLoopBackOff, OOMKilled (Exit Code 137), distributed trace correlations, and high-cardinality error spikes without transferring giant files locally. Use when asked to "analyze remote logs", "remote linux log analysis", "remote pod log analysis", "kubectl logs triage", "ssh log grep", "debug pod crash", "journalctl error analysis", or "parse nginx access logs".

In this repository32 other files it gives its agents.
- AGENTS.mdAGENTS.md
- agent-orchestratorSkill
- algorithmic-complexity-analyzerSkill
- api-securitySkill
- architectural-planningSkill
- caching-queues-reviewerSkill
- code-reviewerSkill
- csharp-developerSkill
- design-pattern-detectorSkill
- detect-overengineeringSkill
- github-security-scanner-hookSkill
- java-developerSkill
- legacy-code-modernizationSkill
- llm-as-judgeSkill
- load-memorySkill
- nodejs-executorSkill
- playwright-bdd-testerSkill
- powershell-writerSkill
- python-api-writerSkill
- python-developerSkill
- python-linterSkill
- react-developerSkill
- save-memorySkill
- scan-halucinated-testsSkill
- scan-repo-readmeSkill
- skill-creatorSkill
- sql-connectorSkill
- sql-executorSkill
- sync-github-forksSkill
- trace-code-contextSkill
- troubleshoot-and-fixSkill
- typescript-developerSkill

The file

We split this skill into the rules it gives an agent

2 rules. About 0 are common, 1 is distinctive, and 1 is very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Compute Where the Data Lives: Never download multi-gigabyte log files over SSH just to search them locally.
line 26
Very specific:
Fail Fast on SSH Handshakes: Always enforce non-interactive flags (-o BatchMode=yes -o ConnectTimeout=5) to prevent script hangs.
line 27

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Remote Pod & Linux Log Analyzer

Staff-level operational framework for searching, streaming, and statistically analyzing remote Linux and Kubernetes pod logs over SSH and kubectl without downloading giant log files locally.

When to Use This Skill

Investigating production incidents, latency spikes, and 5xx HTTP error cascades.
Diagnosing Kubernetes container restarts, CrashLoopBackOff, and OOMKilled (Exit Code 137).
Querying remote servers behind SSH bastions (-J) without interactive password hangs (BatchMode=yes).
Searching uncompressed (.log) and rotated compressed (.gz) logs in-stream using zgrep, ripgrep, or sed.
Aggregating error distributions, calculating latency percentiles (P50/P95/P99), and filtering JSON logs (jq).
Correlating distributed traces (trace_id, correlation_id) across microservices and reverse proxies (Nginx/Envoy).

Architectural Philosophy: Remote Stream Processing

Compute Where the Data Lives: Never download multi-gigabyte log files over SSH just to search them locally. Filter and aggregate on the remote host, streaming only the distilled results.
Fail Fast on SSH Handshakes: Always enforce non-interactive flags (-o BatchMode=yes -o ConnectTimeout=5) to prevent script hangs.
Check Terminated Containers: For crashed pods, inspect kubectl logs --previous and check exit codes.
Never Unpack .gz to Disk: Stream compressed logs with zcat or zgrep to protect node disk space.

Core Knowledge Modules

Load the relevant module based on your task:

Domain	Description	Module File
SSH & Bastions	Non-interactive SSH flags, bastion hopping (`-J`), remote heredoc execution	SSH Execution & Bastions
Remote Staging Protocol	Copying collector to remote `/tmp`, in-situ execution, copying back `.tar.gz`, cleanup	Staging & Copy Protocol
Kubernetes & Pods	`kubectl logs`, multi-container, `--previous`, exit codes (137 OOMKilled), node logs	Pod Log Extraction
Grep & Ripgrep	High-performance regex, context (`-C`), rotated `.gz` files (`zgrep`), time slicing	Grep & Compressed Logs
Awk Stream Parsing	Field extraction, status code distributions, latency percentiles (P95/P99), stack traces	Awk & Stream Parsing
JSON & JQ Parsing	Structured JSON logs (`ndjson`), filtering by level, extracting trace IDs, `@tsv` tables	JSON & JQ Parsing
Journalctl & Dmesg	Systemd unit logs (`-u`), kernel ring buffer (`dmesg -T`), hardware/OOM faults	Systemd & Kernel Dmesg
Incident Triage	5-step triage runbook, error signature clustering, Nginx/Envoy access logs	Incident Triage Runbook

Automation Scripts

Executable extraction tools located in scripts/ following the Remote Staging Protocol:

scripts/remote-collector.sh: Standalone diagnostic worker script staged in /tmp/ on the remote host or pod. Collects systemd priority errors, /var/log/*, dmesg -T OOM events, scrubs secrets, and packs into /tmp/log-bundle-<timestamp>.tar.gz.
scripts/extract-remote-linux-logs.sh: Shell runner that copies remote-collector.sh to remote host /tmp/ via SCP, executes it remotely, copies the resulting .tar.gz bundle back to local ./extracted-logs/, cleans up remote /tmp, and unpacks locally.
```
./.github/skills/remote-pod-log-analyzer/scripts/extract-remote-linux-logs.sh -h 10.0.4.15 -u ubuntu -s kubelet --since "30m"
```
scripts/extract-pod-logs.sh: Shell runner that copies remote-collector.sh to pod /tmp/ via kubectl cp, executes in-situ, copies back the bundle, and cleans up (automatically falling back to kubectl logs streaming for read-only/distroless pods).
```
./.github/skills/remote-pod-log-analyzer/scripts/extract-pod-logs.sh -n prod -p order-service-xyz --previous --since 1h
```

scripts/extract-remote-logs.ps1: Cross-platform PowerShell automation script providing native in-situ remote staging, execution, copy-back, and cleanup for Windows environments.

powershell -File ./.github/skills/remote-pod-log-analyzer/scripts/extract-remote-logs.ps1 -TargetType LinuxHost -RemoteHost 10.0.4.15 -User ubuntu -SystemdUnit kubelet -Since "1h"

References

Remote Pod Log Analyzer Reference Guide — Master command cheatsheet and diagnostic flows.
Troubleshoot and Fix — Isolated reproduction testbeds and circuit breaker remediation.
Algorithmic Complexity Analyzer — Algorithmic time and space analysis.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free