# LogAnalyzer Usage Examples
This document provides practical examples of using the LogAnalyzer MCP Server for different log analysis scenarios.
## Scenario 1: Web Application Error Analysis
### Sample Log
```
2024-01-23 14:32:15 [ERROR] 500 Internal Server Error: /api/users/12345
2024-01-23 14:32:15 [ERROR] Database connection timeout after 30s
2024-01-23 14:32:15 [ERROR] Stack trace:
at DatabaseService.connect (db.js:45)
at UserController.getUser (users.js:78)
at Router.handle (express.js:234)
2024-01-23 14:32:16 [WARN] High memory usage: 89% (threshold: 80%)
2024-01-23 14:32:17 [ERROR] Redis connection lost: ECONNREFUSED
```
### Cursor AI Prompt
```
Analyze this web application error log and help me understand:
1. What's the root cause of the 500 errors?
2. Are the database timeout and Redis connection issues related?
3. What steps should I take to fix these issues?
[Paste log content above]
```
### Expected Analysis Output
- **Root Cause**: Database connection timeouts leading to cascading failures
- **Severity**: High (impacts user experience)
- **Suggested Fixes**:
- Increase database connection pool size
- Add connection retry logic with exponential backoff
- Monitor and optimize slow queries
- Check Redis server health and network connectivity
- **Follow-up Questions**:
- How many concurrent users are accessing the system?
- When did the Redis connection start failing?
- Are there any recent deployment changes?
## Scenario 2: Microservices Log Monitoring
### JSON Structured Logs
```json
{"timestamp":"2024-01-23T14:30:00Z","service":"auth","level":"error","message":"JWT token validation failed","user_id":"u123","token_error":"expired","request_id":"req_456"}
{"timestamp":"2024-01-23T14:30:01Z","service":"payment","level":"fatal","message":"Payment gateway unreachable","gateway":"stripe","error_code":"NETWORK_ERROR","amount":"$99.99","transaction_id":"txn_789"}
{"timestamp":"2024-01-23T14:30:02Z","service":"notification","level":"warn","message":"Email delivery delayed","queue_size":1250,"threshold":1000}
{"timestamp":"2024-01-23T14:30:03Z","service":"user-profile","level":"error","message":"Cache miss for user data","user_id":"u123","cache_key":"profile:u123","fallback":"database"}
```
### Usage with CLI
```bash
# Save logs to file
echo '[JSON logs above]' > microservices.log
# Analyze with CLI
npm run analyze -- microservices.log
```
### Usage with Cursor AI
```
Monitor these microservices logs and help me identify:
1. Which service is experiencing the most critical issues?
2. Are there any cascading failure patterns?
3. What's the impact on user experience?
4. How should I prioritize fixes?
```
## Scenario 3: Real-time Log Monitoring
### Setting up File Watching
**With Cursor AI:**
```
Start monitoring /var/log/myapp/error.log for new critical errors and notify me immediately when issues occur.
```
**With CLI:**
```bash
# Interactive monitoring
npm run analyze -- watch /var/log/myapp/error.log 1000
# Or programmatically
node dist/cli/simple-client.js watch /var/log/myapp/error.log
```
### Monitoring Multiple Files
**Cursor AI Prompt:**
```
Please watch these log files for errors:
- /var/log/nginx/error.log (web server errors)
- /var/log/mysql/error.log (database errors)
- /var/log/redis/redis-server.log (cache errors)
Alert me when new critical issues are detected in any of these files.
```
## Scenario 4: Database Performance Analysis
### Sample MySQL Slow Query Log
```
# Time: 2024-01-23T14:45:00.000000Z
# User@Host: app_user[app_user] @ [192.168.1.100]
# Thread_id: 12345 Schema: production_db
# Query_time: 45.123456 Lock_time: 0.000123 Rows_sent: 1 Rows_examined: 2500000
SELECT u.*, p.* FROM users u
JOIN profiles p ON u.id = p.user_id
WHERE u.created_at > '2024-01-01'
AND p.status = 'active';
# Time: 2024-01-23T14:46:00.000000Z
# User@Host: app_user[app_user] @ [192.168.1.100]
# Thread_id: 12346 Schema: production_db
# Query_time: 30.567890 Lock_time: 0.000089 Rows_sent: 0 Rows_examined: 1800000
UPDATE user_stats SET last_login = NOW()
WHERE user_id IN (SELECT id FROM users WHERE status = 'inactive');
```
### Analysis Prompt
```
Analyze this MySQL slow query log and help me:
1. Identify the most problematic queries
2. Understand why these queries are slow
3. Suggest specific optimizations (indexes, query rewrites, etc.)
4. Estimate the performance impact of fixes
```
## Scenario 5: Security Log Analysis
### Security Event Logs
```
2024-01-23 15:00:01 [SECURITY] Failed login attempt: user=admin, ip=192.168.1.50, attempts=1
2024-01-23 15:00:05 [SECURITY] Failed login attempt: user=admin, ip=192.168.1.50, attempts=2
2024-01-23 15:00:10 [SECURITY] Failed login attempt: user=admin, ip=192.168.1.50, attempts=3
2024-01-23 15:00:15 [SECURITY] Account locked: user=admin, reason=too_many_failed_attempts
2024-01-23 15:00:20 [SECURITY] Suspicious activity: ip=192.168.1.50, action=password_spray_attack
2024-01-23 15:00:25 [SECURITY] IP blocked: ip=192.168.1.50, duration=1h, reason=brute_force
```
### Security Analysis Prompt
```
Analyze these security logs for potential threats:
1. What type of attack patterns do you see?
2. Is this a coordinated attack or isolated incidents?
3. What additional security measures should be implemented?
4. Should I be concerned about system compromise?
```
## Scenario 6: Application Startup and Configuration Issues
### Startup Error Logs
```
2024-01-23 09:00:00 [INFO] Starting MyApplication v2.1.0
2024-01-23 09:00:01 [INFO] Loading configuration from /etc/myapp/config.yaml
2024-01-23 09:00:02 [ERROR] Configuration validation failed
2024-01-23 09:00:02 [ERROR] Missing required environment variable: DATABASE_URL
2024-01-23 09:00:02 [ERROR] Invalid port configuration: expected number, got 'auto'
2024-01-23 09:00:02 [ERROR] SSL certificate not found: /etc/ssl/certs/myapp.crt
2024-01-23 09:00:03 [FATAL] Application startup failed due to configuration errors
2024-01-23 09:00:03 [FATAL] Process exiting with code 1
```
### Startup Debugging Prompt
```
This application is failing to start. Analyze these startup logs and help me:
1. Identify all configuration issues that need to be fixed
2. Prioritize which issues to address first
3. Provide specific commands or steps to resolve each issue
4. Suggest a startup checklist to prevent these issues in the future
```
## Scenario 7: Performance Bottleneck Investigation
### Performance Logs with Metrics
```
2024-01-23 16:30:00 [PERF] Request processing time: 2.5s (threshold: 1s) - /api/search
2024-01-23 16:30:00 [PERF] Database query time: 1.8s - SELECT * FROM products WHERE category IN (...)
2024-01-23 16:30:00 [PERF] Cache miss: key=search_results:electronics, rebuild_time=800ms
2024-01-23 16:30:01 [PERF] Memory usage spike: 1.2GB -> 2.8GB in 10s
2024-01-23 16:30:02 [PERF] GC pressure detected: 15 collections in 30s
2024-01-23 16:30:03 [WARN] Response time SLA breach: 95th percentile = 3.2s (SLA: 2s)
```
### Performance Analysis Prompt
```
Analyze these performance logs to help me optimize the application:
1. What's causing the slow response times?
2. Which performance issues should I tackle first?
3. Are there any memory leaks or resource issues?
4. What specific optimizations would give the biggest performance gains?
```
## Advanced Usage Patterns
### 1. Comparative Analysis
```
Compare the error patterns between these two log files from before and after our latest deployment. Help me understand if the deployment introduced new issues or improved existing ones.
[File 1: pre-deployment logs]
[File 2: post-deployment logs]
```
### 2. Trend Analysis
```
Analyze this week's worth of error logs and help me identify:
- Which errors are increasing in frequency?
- What time patterns exist (peak error times)?
- Which components are becoming less reliable?
- What should be our maintenance priorities?
```
### 3. Root Cause Investigation
```
I'm seeing intermittent 503 errors in production. Analyze these logs and help me trace the root cause by looking at:
- Correlation between different service errors
- Timeline of events leading to failures
- Resource utilization patterns
- External dependencies that might be involved
```
### 4. Capacity Planning
```
Based on these application logs showing resource usage and performance metrics, help me understand:
- When will we hit our capacity limits?
- Which resources are the bottlenecks?
- How should we scale our infrastructure?
- What are the warning signs to monitor?
```
## Best Practices for Log Analysis
### 1. **Structured Logging**
- Use consistent log formats across services
- Include correlation IDs for tracing requests
- Add contextual information (user_id, session_id, etc.)
### 2. **Log Levels**
- Use appropriate log levels (DEBUG, INFO, WARN, ERROR, FATAL)
- Be consistent with severity classification
- Include actionable information in error messages
### 3. **Monitoring Strategy**
- Set up real-time monitoring for critical paths
- Create alerts for specific error patterns
- Monitor both error rates and response times
### 4. **Analysis Workflow**
1. **Immediate**: Address FATAL and high-frequency ERRORs
2. **Short-term**: Investigate WARNINGs and performance issues
3. **Long-term**: Analyze trends and patterns for proactive improvements
## Integration with CI/CD
### Pre-deployment Log Analysis
```bash
# Analyze logs before deployment
npm run analyze -- production-logs-last-24h.log
# Check for specific error patterns
grep -E "(FATAL|ERROR)" app.log | npm run analyze -- -
```
### Post-deployment Monitoring
```
After deployment, monitor these logs for 30 minutes and alert me if error rates increase by more than 50% compared to the baseline:
- Application logs: /var/log/app/app.log
- Web server logs: /var/log/nginx/error.log
- Database logs: /var/log/mysql/error.log
```
This comprehensive set of examples should help you get started with effective log analysis using the LogAnalyzer MCP Server!