React on Rails HN RSC Demo

nevon 1d ago

I feel like this is a bit of a "draw the rest of the owl" problem. With a couple of terabytes of logs per day, god knows how many metric timeseries, thousands of cloud environments, thousands of repositories, hundreds of thousands of build pipelines running every day, it's not something you can just point an agent at and call it a day. Segmenting and correlating the data is _hard_. Even something as seemingly simple as "p95 latency of this endpoint has increased - what repo contains the responsible code" is difficult to do, even if you are willing to give an agent read access to everything.

suncemoje 19h ago

> With a couple of terabytes of logs per day, god knows how many metric timeseries, thousands of cloud environments, thousands of repositories, hundreds of thousands of build pipelines running every day, it's not something you can just point an agent at and call it a day. Segmenting and correlating the data is _hard_.

In my experience, this is exactly what LLMs / a simple agentic system with one or more sub-agents and a few tools are extremely good at.

cloudrkt 1d ago

Could a system one model like Jev not provide some sort of "pre-classification" on these logs to make this in to something workable?

jeffbee 1d ago

Yeah something about this whole concept is way, way off. The energy, and therefore cost, of an LLM analyzing every data point of every time series is many orders of magnitude too high, unless your operations are trivial.

srdjanr 23h ago

I don't think the idea is to give agents raw data, but for it to run many queries. Humans also don't look at terabytes of raw logs.

jubilee33 1d ago

I encounter this problem a lot in my work. Agents being run on a cron for instance, where the task is not dynamic and a simple script can be more than sufficient. As agentic use increases i think it will get worse, as scripting is hard to do elegantly, even if the agent is writing the script. But having an agentic call for every single detail is just so inefficient.

antupis 1d ago

I think there running both will be winning combination scripts/classical ML do large scale crunching and when they find some anomaly or some threshold creates alert. Agents will create initial report and maybe create first pr for developer.

radim_h 5h ago

I think access control becomes another challenge here. An agent investigating an incident might need access to logs, cloud APIs, and several repos, but probably shouldn't have write access to all of them or access to some other API.

It gets even more interesting if you let it take remediation actions. How are people separating investigation permissions from actual changes?

I'm currently using https://stashbase.dev daily (I'm also the founder).

t0mas88 1d ago

Interesting idea. I guess the main challenge is to create some kind of harness to make the input volume appropriate for an LLM to evaluate. Billions of the same log events from a raw stream will be cost prohibitive and not find you much interesting output. But a trend in some value changing would.

As a human I look at Datadog or Grafana plus some log searches, maybe those need to become tools for the agent.

suncemoje 19h ago

> In my iteration on this, I’ve found that a pure agent loop is not the optimal shape for agentic monitors. Rather, a harness that allows the agent to write a spec of how to monitor, along with a deterministic system for running those specs, produces significantly cleaner signals with dramatically lower token usage.

Would be curious:

1. How / at what interval does it run those specs?

2. Are these basically just queries? Or what's included in a "spec" that an agent executes on?

solomonb 17h ago

I made a project for this earlier this year: https://github.com/solomon-b/friendly-ghost/

You can can read from Loki or Journald and use regex or alert levels to filter what you pass to the LLM.

I've been using it with deepseek for my homelab. Its pretty helpful.

yegle 1d ago

I have been doing something similar but much smaller scale: having a daily scheduled task from Antigravity to ADB connect to my phone and dump all logs and do analysis to let me know if there's any app behaving weirdly (e.g. repeated crashes).

The adb connection is intentionally over Tailscale so in the morning after I connect to some random WiFi (Android remote debugging is only enabled w/ WiFi connection) I can start reading the report, then quote and ask Gemini to fix some issues.

skyfine 1d ago

We have been doing this recently after some security incidents. Constant monitoring of all security related events, and being able spot anomalys which our normal system isn’t able to catch. The active part is just emailing us right now, but I am considering adding some light lock down actions.

kelseydh 1d ago

It feels like the real value here will be from monitoring services like DataDog adding this functionality to their own internal products, rather than companies rolling their own agentic monitoring. Datadog's Bits AI is already quite helpful in scanning monitoring data for insights.

theshrike79 1d ago

Without even knowing what it is, I'm kinda guessing Datadog's AI also has a nice hefty price tag attached to it?

And if not today, it will have one soon.

forgotmypw17 1d ago

This is already a product: https://www.tasksmind.com/

(Disclosure: Not mine, but a friend's.)

2bird3 1d ago

Feels like the author hits the nail on the head but leaves out higher cardinality data. Would love to know how Anthropic goes about ingesting and analyzing their logs, of which they presumably have many.

appplication 1d ago

Ingesting? Presumably Kafka. Analyzing? Presumably a fairly large analytics org.

rihegher 23h ago

Claude code is regularly calling some datadog API

renegade-otter 1d ago

This is like tokenmaxxing for observability?

simianwords 1d ago

This is a thought terminating cliche. There’s a tendency to sneer at any proposed change to how the industry works because apparently we are already at the global optimum and every new change is just marketing and hype.

It’s so obvious that we will have round the clock “intelligent” monitoring.

Token costs are getting cheaper by the month. There’s a 2x drop in prices every month or so.

It’s more useful to predict where the industry will go forward.

esafak 1d ago

How are you setting the alerts? Are you using anomaly detection? If so, what kind?

simianwords 1d ago

https://news.ycombinator.com/item?id=50134310

I made a comment touching on similar things a while back. This is obviously the future.

Expect a lot of techno conservatives and greybeards pushing back on this.

“Just have better unit tests”

“Just have traditional alerts using SLO budgets”

Agentic Monitoring (benjamincongdon.me)