Five ways a file admits something went wrong
No thresholds to configure, no query language, no training data. The baseline is computed from the file in front of you as it parses, and the findings are ranked and capped so the panel stays readable.
Lives in the findings panel — what the file admits
Silence gap · high
sshd stopped logging entirely 07:03 – 07:07
Frequency spike · high
ERROR rate ~1/min → 18/min, held 8 min
Repeat storm · medium
One signature is 61% of all errors and warnings
New signature · medium
"connection reset by peer" not seen before in this file
The five detectors.
Named here exactly as they are named in the source. Two of them — silence gap and repeat storm — find things a search box structurally cannot: one is about lines that are missing, the other about lines you would dismiss as noise.
- 01
Frequency spike
A level whose rate jumps against its own trailing baseline and stays there. The finding carries the rate it moved from, the rate it moved to, and how long it held.
- 02
New signature
A message shape that has not appeared before in this file. If it goes on to repeat, the finding says how many more times it occurred.
- 03
Silence gap
A service that stopped logging entirely. The absence of lines is the finding — measured against that service's own typical interval, not a fixed threshold.
- 04
Outlier value
A duration in the message text that runs long against what is typical for its neighbours. One entry took 4.2s where the usual is 30ms.
- 05
Repeat storm
One message shape grown large enough to account for a real share of every error and warning in the file — the cluster that became worth reporting.
Here are the actual numbers.
“Smart thresholds” is what a tool says when it would rather you didn’t ask. These are the constants the detectors actually use. Read them, decide whether they match how your services behave, and you know in advance what will and won’t be reported.
- Minimum entries before anything is flagged
- 20
- Below that there is no baseline to be unusual against.
- Frequency spike trigger
- ≥ 4× trailing median
- Measured over the previous 8 buckets, and only if the bucket also holds 5+ entries.
- Silence gap trigger
- ≥ 6× typical interval
- Relative to that service's own rhythm, with a 60-second floor — not a fixed timeout.
- Outlier value trigger
- ≥ 6× typical, ≥ 50 ms
- Both must hold, so a 1 ms → 7 ms jump doesn't get reported as a finding.
- Repeat storm trigger
- ≥ 25% of errors + warnings
- And at least 10 occurrences, so a small file can't produce a storm out of three lines.
- Findings kept
- 8 per type · 20 total
- Severity-ranked and capped, so the panel stays a list you read rather than a feed you scroll.
All of it runs locally: trailing-window medians, message-shape normalisation and gap timing. There is no model involved and no network call to make.
faq
Common questions
keep reading
Where this fits
No thresholds to set before it works.
Open a file with more than twenty entries and the findings are already computed. Nothing to configure, nothing to train, nothing sent anywhere.