code-runtime-diagnose

Code runtime diagnosis

Connect static code paths to runtime evidence through the Graylog Agent Toolkit MCP. Keep code inference separate from observed log facts.

Workflow

1. Confirm the environment, symptom time, timezone, business identifier, and requested scope. Begin read-only unless the user also requests a fix.
2. Locate the entrypoint and follow the relevant branches, async submissions, callbacks, consumers, and persistence boundaries.
3. Extract stable literal fragments from relevant log statements. Prefer text such as 收到回调, callback handle success, or a structured stage= value over class names or variable-only text.
4. Collect known identifiers such as studentExamId, studentId, taskId, requestNo, traceId, requestId, itemKey, ossKey, and bizType.
5. If a matching business profile exists, read it with graylog_get_profile. Profiles add vocabulary, entrypoints, stages, and correlation keys; they do not replace code inspection.
6. Call graylog_diagnose_code_logs with the literals, identifiers, profile, and the narrowest useful time range. If exact absolute times are unavailable, use a short relative range and state it.
7. Follow identifiers discovered by the first result across async boundaries. Use graylog_search_messages only for a targeted raw Lucene query that the correlation tool cannot express.
8. Map important events back to source files and branch conditions. Identify the first missing, failed, skipped, or contradictory stage.
9. Report the timeline and the smallest next verification step. Do not edit code, rerun a job, or change data unless the user authorized it.

Query rules

• Use UTC RFC3339 timestamps for MCP absolute ranges; translate user-local time explicitly.
• Search stable literals and exact identifiers together when that narrows results without hiding alternate branches.
• Start with at most a few strong terms. Expand through returned correlation values instead of using a broad wildcard query.
• Treat no results as an observation, not proof that code did not execute. Check environment, time range, timezone, stream, ingestion, and literal accuracy.
• Never place Graylog credentials, session IDs, cookies, authorization headers, or signed URL secrets in prompts or reports.