🐱喵学堂

🤖 The Modern AI Developer · After Launch: Keep It Running

AI-Native Ops: Letting an Agent Triage Production Issues

The Agent reads logs, does first-pass triage, suggests fixes; the human makes the call

一句话先懂 · TL;DR

Use an AI agent as an on-call assistant: it reads logs, does first-pass triage, and suggests fixes while a human keeps every final call, in a safe workflow.

The Agent as 'On-Call Assistant,' Not 'Hands-Off Boss'

In the last lesson you learned to read logs and set alerts. But when an alert fires at 3 a.m., a wall of dense logs has to be read and summarized by a human—that's exhausting. AI-native ops means having the Agent be your on-call assistant: it reads the logs first, summarizes "roughly where the problem is," and gives you a fix suggestion.

🔆The Agent is like an intern doctor: it can quickly read the scans and write up an initial diagnosis and suggested prescription. But whether to actually prescribe or operate is for the attending physician (you) to decide.
💡What the Agent saves you is the time spent reading logs, finding clues, and drafting a plan—not the responsibility for decisions that are "irreversible once pressed."

Who Does What: The Agent Looks, the Human Decides

Split the work clearly and trouble is less likely:

The Agent's job: read through a big chunk of logs, find suspicious errors, summarize "probably a payment-API timeout," and offer a few candidate fix suggestions.
The human's job: judge whether the suggestion is sound, decide whether to execute, and for actions that change the current state—restarting the service, rolling back a version, deleting data—the human confirms.

⚠️Never let the Agent automatically execute irreversible high-risk operations (drop a database, roll back production, change configs). One misread and it could turn a small failure into a big incident. Reading and suggesting can be automatic; acting needs a human nod. (The Agent may hallucinate—inventing errors that aren't in the logs or attributing the cause wrongly—so always take its conclusion back to the raw logs to verify.)

A Safe 'Agent Reads Logs, Human Decides' Workflow

String it into a pipeline, each step crystal clear:
1. Alert fires → 2. Feed the logs for the relevant time window to the Agent → 3. The Agent outputs initial triage + fix suggestions → 4. The human reads the suggestions and decides → 5. The human (or after human confirmation) executes the fix → 6. Recheck whether the metrics recovered.

Write clear boundaries in the instructions to the Agent, so it only looks, doesn't act:

你是运维值班助手。我会把最近 30 分钟的线上日志贴给你。
请你：
1) 找出其中的 error，并按出现时间排序；
2) 用一句话总结“最可能的故障原因”；
3) 给出 1~3 条修复建议，并标注每条的风险高低。
注意：只做分析和建议，不要假装已经执行任何操作。
💡Explicitly tell the Agent to "only analyze, don't execute," and require it to tag a risk level for each suggestion, so when you decide you can try the low-risk ones first.

自测 · 学完检查一下

想真正动手做题、记进度、攒连胜？到互动课里练。

Having the Agent take part in ops mainly saves you which kind of work?

答案：Reading massive logs, finding clues, summarizing the problem, drafting fix plans

The Agent is an on-call assistant, good at quickly reading logs, triaging, and writing suggestions; high-risk, irreversible decisions still rest with humans.

Judge: when an alert fires at 3 a.m. and a person has to read and summarize a pile of logs, that's exactly a typical scenario where the Agent can help.

答案：True

Reading massive logs and summarizing suspicious points is exactly the Agent's strength, greatly reducing the burden of a person combing through line by line at night.

Judge: for speed, the Agent should automatically roll back the production version the moment it suspects a failure, without waiting for human confirmation.

答案：False

Rolling back production is a high-risk, possibly irreversible action that changes the current state and must have human confirmation. One Agent misread could turn a small failure into a big incident.

On what to hand to the Agent and what must rest with a human, which division of labor is most appropriate?

答案：Hand log summarization and fix suggestions to the Agent; restarting the service / rolling back is decided by a human

The line is: reading and suggesting can be automatic, but state-changing actions need a human nod. This is both effort-saving and safe.

When designing an "Agent reads logs, human decides" flow, which instruction best meets the "only look, don't act" safety requirement?

答案：Please analyze the logs and give fix suggestions, but don't pretend you've already executed anything

A safe flow draws clear boundaries for the Agent: analyze only, suggest only, don't execute; whether to execute is decided by the human.

In the "Agent reads logs, human decides" flow, have the Agent tag each fix suggestion with a "high/medium/low" ____ level, so you can try the safest one first. (Fill in.)

答案：risk

Having the Agent tag each suggestion's risk level lets the human pick low-risk options first, fixing step by step and lowering the chance of a second incident.

想边练边学，而不只是读？

到互动课里答题、记进度、攒连胜——游客即可试学，无需注册。

进入互动课程 →

Learn something new — don't miss updates

New courses, features and learning tips. Occasional emails, unsubscribe anytime.