steelmorgan/event-log-analysis
framework_eng/skills/tool-usage/diagnostics/event-log-analysis/SKILL.md
Use for finding errors, events, and user actions in the registration log (RJ) via ClickHouse. Helps localize the time and context of a failure from the event log before turning to the tech log.
$ install --global
skillsauthnpx skillsauth add steelmorgan/1c-agent-based-dev-framework event-log-analysisInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 13, 2026, 6:03 AM5.9s1 file scanned
SKILL.md
- name:
- event-log-analysis
- description:
- Use for finding errors, events, and user actions in the registration log (RJ) via ClickHouse. Helps localize the time and context of a failure from the event log before turning to the tech log.
Registration Log Analysis (Event Log)
The RJ is a read-only source. Do not include raw entries in the output without masking personal data. By default, mode: "minimal".
For DBMS queries, locks, and platform exceptions, use tech-log-analysis.
When to Use
| Trigger | Action |
|---------|----------|
| The user reports an error | First the latest Error, then a narrow time window |
| An error for a specific period | search_event_log with from/to |
| Auditing user actions | search_event_log with a user filter |
| Checking object changes | search_event_log with a metadata filter |
| Database state after tests | search_event_log with from: test_start_time, limit: 20 |
| Vanessa run failed | First the latest Error, if empty — without a level filter |
Search Algorithm
- Get
cluster_guidandinfobase_guidfromcluster_map.yaml. - Determine the strategy (see the cascade below).
- Run
search_event_logwith the required filters. - Analyze the
records:event_time,event_presentation,comment,metadata_presentation. - When a metadata object is mentioned, use
navigate_symbolto jump to the code.
Filtering Cascade
- First — the latest records with
level: "Error"(withoutfrom/towhen the exact time is unknown). - If empty — repeat without the level filter.
- If the time is known — narrow
from/toto ±15 minutes. - If the RJ gives no answer — move to
tech-log-analysis.
Timezone drift: local time and ClickHouse may differ; therefore, step 1 without a time filter is more reliable.
search_event_log(
cluster_guid: "...",
infobase_guid: "...",
from: "2025-02-11T13:00:00Z",
to: "2025-02-11T14:00:00Z",
level: "Error",
mode: "minimal",
limit: 100
)
Interpreting Results (After Tests / Vanessa)
| Situation | Conclusion |
|-----------|-------|
| No records | The database did not start / the RJ is unavailable |
| There are events, but Error is absent | The database is alive and the tests are running |
| The last event is a session end without errors | The tests completed successfully |
| There is an Error in event_presentation / comment | Analyze comment and metadata_presentation |
| Security warning | Move to visual diagnostics via GUI/screenshot |
Linking an RJ Entry with Code
After obtaining event_presentation and metadata_presentation:
- If
metadata_presentationcontains the name of a metadata object, callnavigate_symbolto jump to the code. - If
commentmentions an error text or a procedure name, search the codebase for the comment text. - In the report, specify the concrete module and procedure (not only the metadata object name). Format:
ОбщийМодуль.ОбработкаОшибок → ЗафиксироватьОшибку().
Correlation ID and Session
If the comment field contains a session identifier, an HTTP request identifier, or a correlation id:
- Extract the value and preserve it in the response context.
- Explicitly include in the output:
session=...,corrId=...orhttpReq=.... - If further investigation is needed, pass these identifiers to
tech-log-analysisas filters (search_tech_logwithsession/corrId).
The goal is to preserve correlation keys for the next step without mixing RJ and Tech Log analysis in a single query.
Security
- Mask full names, tax IDs, and contact details in the output.
- By default,
mode: "minimal". - Narrow
from/toto the minimum necessary period. - Do not request more than 1000 records during the initial search.
Capabilities
| Capability | Purpose |
|------------|------------|
| search_event_log | Search the registration log (via ClickHouse) |
| navigate_symbol | Jump to code by metadata from an RJ entry |
Common Mistakes
| Error | Workaround |
|--------|---------------|
| GUIDs are not from cluster_map.yaml | Read the config; if it is missing, ask the user |
| ClickHouse is unavailable | Record the reason; suggest an alternative via the Tech Log |
| Time range is too wide — timeout | Narrow the window to 15–30 minutes; reduce limit |
| No errors in the RJ | Cascade: no level filter → narrow the window → Tech Log |
depends_on: []
Related Skills
steelmorgan/source-of-truth
testing
VerifiedTrustedCommunity
MUST use BEFORE making a judgment about the cause of a conflict, a test failure, or an artifact dispute. Defines the end-to-end verification method L1→L6 and the classification of the first broken link.
69SKILL.mdUpdated Jun 13, 2026
steelmorgan/skill-learning
development
VerifiedTrustedCommunity
MUST use AFTER a work cycle with ≥2 iterations (wrote → error → fixed → success). Provides the retrospective procedure and the format for recording practice/anti-patterns in references/learned-patterns.md or {project}/.context/learned-patterns.md.
69SKILL.mdUpdated Jun 13, 2026
steelmorgan/rlm-workflow
tools
VerifiedTrustedCommunity
MUST use WHEN you are writing reusable knowledge into RLM (pattern / architectural decision / stable domain fact) OR reading it before a non-trivial task/solution in the domain. Provides the breakdown of native-push vs RLM-pull, tools for writing and reading RLM, H-MEM levels, and hygiene.
69SKILL.mdUpdated Jun 13, 2026
steelmorgan/quick-fix
testing
VerifiedTrustedCommunity
MUST use WHEN the task is classified as simple (< 20 lines, 1 file, no new metadata objects, no architectural decisions). Provides a short cycle of 3 steps with a guard on the self path and mandatory verify.
69SKILL.mdUpdated Jun 13, 2026