syslog-postmortem 1.0.0__py3-none-any.whl

syslog_postmortem/__init__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+__version__ = "1.0.0"
+__all__ = ["main"]

syslog_postmortem/analyzer.py

@@ -0,0 +1,231 @@
+"""
+Pattern analysis, deduplication, cascade detection and contributing factor generation.
+"""
+from collections import Counter, defaultdict
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+from typing import List, Dict, Optional
+
+from .collector import RawEntry, priority_to_severity
+from .patterns import match_patterns, Pattern
+
+
+# ── Normalised event ──────────────────────────────────────────────────────────
+
+@dataclass
+class Event:
+    timestamp: datetime
+    service: str
+    severity: str           # CRITICAL | ERROR | WARNING | INFO
+    message: str
+    source: str
+    patterns: List[Pattern] = field(default_factory=list)
+    count: int = 1          # after deduplication
+
+
+# ── Analysis result ───────────────────────────────────────────────────────────
+
+@dataclass
+class AnalysisResult:
+    events: List[Event]
+    timeline: List[Event]                           # deduplicated, sorted
+    by_severity: Dict[str, List[Event]]
+    by_service: Dict[str, List[Event]]
+    pattern_counts: Dict[str, int]                  # pattern_name → count
+    contributing_factors: List[str]
+    action_items: List[str]
+    first_anomaly: Optional[Event]
+    peak_window: Optional[datetime]                 # minute with most errors
+    services_affected: List[str]
+    total_raw: int
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+def _deduplicate(events: List[Event], window_seconds: int = 60) -> List[Event]:
+    """
+    Merge identical messages that repeat within `window_seconds`.
+    Keeps the first occurrence with a count of how many times it appeared.
+    """
+    result: List[Event] = []
+    seen: Dict[str, Event] = {}
+
+    for ev in events:
+        key = (ev.service, ev.message[:120])
+        if key in seen:
+            last = seen[key]
+            if (ev.timestamp - last.timestamp).total_seconds() <= window_seconds:
+                last.count += 1
+                continue
+        seen[key] = ev
+        result.append(ev)
+
+    return result
+
+
+def _peak_minute(events: List[Event]) -> Optional[datetime]:
+    buckets: Counter = Counter()
+    for ev in events:
+        if ev.severity in ('CRITICAL', 'ERROR', 'WARNING'):
+            buckets[ev.timestamp.replace(second=0, microsecond=0)] += 1
+    return buckets.most_common(1)[0][0] if buckets else None
+
+
+def _detect_cascades(events: List[Event], window_seconds: int = 120) -> List[str]:
+    """
+    Detect cascading failures: service A fails, service B fails shortly after.
+    Returns human-readable descriptions.
+    """
+    cascades = []
+    criticals = [e for e in events if e.severity == 'CRITICAL']
+    errors = [e for e in events if e.severity == 'ERROR']
+
+    for trigger in criticals:
+        for follow in errors:
+            if follow.service == trigger.service:
+                continue
+            delta = (follow.timestamp - trigger.timestamp).total_seconds()
+            if 0 < delta <= window_seconds:
+                cascades.append(
+                    f"**{follow.service}** errors began "
+                    f"**{int(delta)}s** after first **{trigger.service}** critical event "
+                    f"({trigger.timestamp.strftime('%H:%M:%S')})"
+                )
+                break  # one cascade per trigger service pair
+
+    return cascades
+
+
+# ── Main analyser ─────────────────────────────────────────────────────────────
+
+def analyze(raw: List[RawEntry], services_filter: List[str] = None) -> AnalysisResult:
+    total_raw = len(raw)
+
+    # 1. Normalise RawEntry → Event and run pattern matching
+    events: List[Event] = []
+    for r in raw:
+        if services_filter and r.service.lower() not in [s.lower() for s in services_filter]:
+            continue
+        severity = priority_to_severity(r.priority)
+        matched = match_patterns(r.message)
+        # Upgrade severity based on pattern if stricter
+        sev_rank = {'CRITICAL': 0, 'ERROR': 1, 'WARNING': 2, 'INFO': 3, 'DEBUG': 4}
+        for p in matched:
+            if sev_rank.get(p.severity, 4) < sev_rank.get(severity, 4):
+                severity = p.severity
+        events.append(Event(
+            timestamp=r.timestamp,
+            service=r.service,
+            severity=severity,
+            message=r.message,
+            source=r.source,
+            patterns=matched,
+        ))
+
+    # 2. Deduplicate
+    timeline = _deduplicate(events)
+
+    # 3. Group by severity and service
+    by_severity: Dict[str, List[Event]] = defaultdict(list)
+    by_service:  Dict[str, List[Event]] = defaultdict(list)
+    for ev in timeline:
+        by_severity[ev.severity].append(ev)
+        by_service[ev.service].append(ev)
+
+    # 4. Pattern counts
+    pattern_counts: Counter = Counter()
+    for ev in timeline:
+        for p in ev.patterns:
+            pattern_counts[p.name] += ev.count
+
+    # 5. First anomaly (first CRITICAL or ERROR)
+    first_anomaly = next(
+        (e for e in timeline if e.severity in ('CRITICAL', 'ERROR')), None
+    )
+
+    # 6. Peak minute
+    peak_window = _peak_minute(timeline)
+
+    # 7. Services affected (those with at least one ERROR+)
+    services_affected = sorted({
+        e.service for e in timeline
+        if e.severity in ('CRITICAL', 'ERROR')
+    })
+
+    # 8. Contributing factors
+    factors: List[str] = []
+
+    # Restart loops
+    restart_counts = Counter(
+        e.service for e in timeline
+        if any(p.name == 'service_restart' for p in e.patterns)
+    )
+    for svc, cnt in restart_counts.most_common():
+        factors.append(
+            f"**Service instability**: `{svc}` triggered restart-loop detection **{cnt} time(s)**"
+        )
+
+    # OOM events
+    oom_count = pattern_counts.get('oom', 0)
+    if oom_count:
+        factors.append(
+            f"**Memory pressure**: OOM killer fired **{oom_count} time(s)** during the window"
+        )
+
+    # Disk full
+    if pattern_counts.get('disk_full', 0):
+        factors.append("**Disk exhaustion**: 'No space left on device' events detected")
+
+    # Auth failure burst (>5 in window)
+    auth_count = sum(
+        e.count for e in timeline
+        if any(p.name == 'auth_failure' for p in e.patterns)
+    )
+    if auth_count >= 5:
+        factors.append(
+            f"**Auth anomaly**: Burst of **{auth_count} authentication failure(s)** detected"
+            " — possible brute-force attempt"
+        )
+
+    # Cascading failures
+    factors.extend(_detect_cascades(timeline))
+
+    # High error density (>30 error events in any 5-minute window)
+    buckets: Counter = Counter()
+    for ev in timeline:
+        if ev.severity in ('CRITICAL', 'ERROR'):
+            slot = ev.timestamp.replace(second=0, microsecond=0)
+            slot = slot.replace(minute=(slot.minute // 5) * 5)
+            buckets[slot] += ev.count
+    dense = [(t, c) for t, c in buckets.items() if c >= 30]
+    for t, c in sorted(dense):
+        factors.append(
+            f"**Error burst**: **{c} errors** in the 5-minute window starting "
+            f"{t.strftime('%H:%M')}"
+        )
+
+    if not factors:
+        factors.append("No specific contributing factors auto-detected — manual analysis required")
+
+    # 9. Action items (deduplicated from pattern hints)
+    seen_hints: set = set()
+    action_items: List[str] = []
+    for ev in timeline:
+        for p in ev.patterns:
+            if p.action_hint not in seen_hints:
+                seen_hints.add(p.action_hint)
+                action_items.append(p.action_hint)
+
+    return AnalysisResult(
+        events=events,
+        timeline=timeline,
+        by_severity=dict(by_severity),
+        by_service=dict(by_service),
+        pattern_counts=dict(pattern_counts),
+        contributing_factors=factors,
+        action_items=action_items,
+        first_anomaly=first_anomaly,
+        peak_window=peak_window,
+        services_affected=services_affected,
+        total_raw=total_raw,
+    )

syslog_postmortem/cli.py

@@ -0,0 +1,157 @@
+#!/usr/bin/env python3
+import argparse
+import sys
+from datetime import datetime, timedelta
+from pathlib import Path
+from shellcolorize import Color
+
+from .collector import collect_all
+from .analyzer import analyze
+from .renderer import render_markdown, render_html
+
+VERSION = "1.0.0"
+
+
+def _header() -> None:
+    title = 'syslog-postmortem'
+    w = len(title) + 6
+    print()
+    print(f"  {Color.CYAN}╔{'═' * w}╗{Color.RESET}")
+    print(f"  {Color.CYAN}║{Color.RESET}  {Color.BOLD}{Color.CYAN}{title}{Color.RESET}  {Color.CYAN}║{Color.RESET}")
+    print(f"  {Color.CYAN}╚{'═' * w}╝{Color.RESET}")
+    print()
+
+
+def _step(msg: str) -> None:
+    print(f"  {Color.CYAN}▶{Color.RESET}  {msg}")
+
+
+def _ok(msg: str) -> None:
+    print(f"  {Color.GREEN}✔{Color.RESET}  {msg}")
+
+
+def _warn(msg: str) -> None:
+    print(f"  {Color.YELLOW}⚠{Color.RESET}  {msg}")
+
+
+def _err(msg: str) -> None:
+    print(f"  {Color.RED}✖{Color.RESET}  {msg}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog='postmortem',
+        description='Generate a structured postmortem draft from system logs.',
+    )
+    parser.add_argument('--from', dest='since', required=True,
+                        metavar='DATETIME',
+                        help='Start of incident window, e.g. "2026-05-10 14:00"')
+    parser.add_argument('--to', dest='until', required=True,
+                        metavar='DATETIME',
+                        help='End of incident window, e.g. "2026-05-10 16:00"')
+    parser.add_argument('--title', default=None,
+                        help='Postmortem title (default: auto-generated)')
+    parser.add_argument('--services', default=None,
+                        help='Comma-separated list of services to focus on, e.g. nginx,postgresql')
+    parser.add_argument('--output', '-o', default=None,
+                        help='Output file path (default: postmortem_YYYYMMDD_HHMM.md)')
+    parser.add_argument('--format', choices=['markdown', 'html'], default='markdown',
+                        help='Output format (default: markdown)')
+    parser.add_argument('--no-files', action='store_true',
+                        help='Skip /var/log file parsing, use journalctl only')
+    parser.add_argument('--priorities', default='0..4',
+                        help='journalctl priority filter (default: 0..4 = emerg..warning)')
+    parser.add_argument('-v', '--version', action='version', version=f'postmortem {VERSION}')
+    args = parser.parse_args()
+
+    # ── Validate timestamps ────────────────────────────────────────────────────
+    fmt = '%Y-%m-%d %H:%M'
+    try:
+        since_dt = datetime.strptime(args.since, fmt)
+        until_dt = datetime.strptime(args.until, fmt)
+    except ValueError:
+        _err('Dates must be in format "YYYY-MM-DD HH:MM"')
+        sys.exit(1)
+
+    if until_dt <= since_dt:
+        _err('--to must be after --from')
+        sys.exit(1)
+
+    if (until_dt - since_dt) > timedelta(hours=72):
+        _warn('Window is > 72 hours — this may produce a very large report')
+
+    # ── Setup ──────────────────────────────────────────────────────────────────
+    _header()
+
+    services = [s.strip() for s in args.services.split(',')] if args.services else None
+    title = args.title or f"Incident {since_dt.strftime('%Y-%m-%d')}"
+
+    ext = 'html' if args.format == 'html' else 'md'
+    output_path = args.output or f"postmortem_{since_dt.strftime('%Y%m%d_%H%M')}.{ext}"
+
+    print(f"  {Color.DIM}Window  : {args.since} → {args.until}{Color.RESET}")
+    print(f"  {Color.DIM}Services: {', '.join(services) if services else 'all'}{Color.RESET}")
+    print(f"  {Color.DIM}Output  : {output_path}{Color.RESET}")
+    print()
+
+    # ── Collect ────────────────────────────────────────────────────────────────
+    _step('Collecting logs...')
+    raw = collect_all(
+        since=args.since,
+        until=args.until,
+        units=services,
+        include_files=not args.no_files,
+        priorities=args.priorities,
+    )
+
+    if not raw:
+        _warn('No log entries found in the specified window.')
+        _warn('Check that journalctl is available and the time window is correct.')
+        sys.exit(0)
+
+    _ok(f"Collected {len(raw)} raw entries")
+
+    # ── Analyse ────────────────────────────────────────────────────────────────
+    _step('Analysing patterns...')
+    result = analyze(raw, services_filter=services)
+    _ok(f"Found {len(result.timeline)} unique events across "
+        f"{len(result.by_service)} services")
+
+    sev_summary = ', '.join(
+        f"{sev}: {len(result.by_severity[sev])}"
+        for sev in ['CRITICAL', 'ERROR', 'WARNING']
+        if result.by_severity.get(sev)
+    )
+    if sev_summary:
+        print(f"  {Color.DIM}  → {sev_summary}{Color.RESET}")
+
+    if result.contributing_factors:
+        _ok(f"Detected {len(result.contributing_factors)} contributing factor(s)")
+
+    # ── Render ─────────────────────────────────────────────────────────────────
+    _step(f'Generating {args.format} postmortem...')
+    md = render_markdown(result, title, args.since, args.until, services)
+
+    if args.format == 'html':
+        output = render_html(md, title)
+    else:
+        output = md
+
+    Path(output_path).write_text(output, encoding='utf-8')
+    _ok(f"Postmortem saved to {Color.BOLD}{output_path}{Color.RESET}")
+
+    # ── Quick summary ──────────────────────────────────────────────────────────
+    print()
+    if result.first_anomaly:
+        print(f"  {Color.DIM}First anomaly : "
+              f"{result.first_anomaly.timestamp.strftime('%H:%M:%S')} — "
+              f"{result.first_anomaly.service}{Color.RESET}")
+    if result.services_affected:
+        print(f"  {Color.DIM}Affected      : {', '.join(result.services_affected)}{Color.RESET}")
+    if result.action_items:
+        print(f"  {Color.DIM}Action items  : {len(result.action_items)} generated{Color.RESET}")
+    print()
+
+
+if __name__ == '__main__':
+    main()

syslog_postmortem/collector.py

@@ -0,0 +1,228 @@
+"""
+Log collection from journalctl (primary) and /var/log files (fallback/supplement).
+"""
+import json
+import re
+import subprocess
+from dataclasses import dataclass, field
+from datetime import datetime
+from pathlib import Path
+from typing import List, Optional
+
+
+# ── Data model ────────────────────────────────────────────────────────────────
+
+@dataclass
+class RawEntry:
+    timestamp: datetime
+    service: str
+    priority: int       # syslog priority 0-7 (0=emerg, 7=debug)
+    message: str
+    source: str         # 'journald' | 'syslog' | 'auth' | 'dmesg'
+    hostname: str = ''
+    pid: Optional[int] = None
+
+
+# ── Priority helpers ──────────────────────────────────────────────────────────
+
+PRIORITY_MAP = {
+    0: 'CRITICAL', 1: 'CRITICAL', 2: 'CRITICAL',
+    3: 'ERROR',
+    4: 'WARNING',
+    5: 'INFO', 6: 'INFO', 7: 'DEBUG',
+}
+
+
+def priority_to_severity(p: int) -> str:
+    return PRIORITY_MAP.get(p, 'INFO')
+
+
+# ── journalctl ────────────────────────────────────────────────────────────────
+
+def collect_journalctl(since: str, until: str,
+                       units: List[str] = None,
+                       priorities: str = '0..4') -> List[RawEntry]:
+    """
+    Collect entries from systemd journal.
+    `priorities` controls syslog priority filter (default: emerg..warning).
+    Returns an empty list if journalctl is unavailable.
+    """
+    cmd = [
+        'journalctl',
+        '--since', since,
+        '--until', until,
+        '--output', 'json',
+        '--no-pager',
+        '--priority', priorities,
+    ]
+    if units:
+        for u in units:
+            cmd += ['-u', u]
+
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return []
+
+    entries = []
+    for line in result.stdout.splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            obj = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+
+        ts_us = int(obj.get('__REALTIME_TIMESTAMP', 0))
+        if not ts_us:
+            continue
+
+        ts = datetime.fromtimestamp(ts_us / 1_000_000)
+        service = (obj.get('_SYSTEMD_UNIT') or
+                   obj.get('SYSLOG_IDENTIFIER') or
+                   obj.get('_COMM') or 'unknown')
+        service = service.removesuffix('.service')
+
+        priority = int(obj.get('PRIORITY', 6))
+        message = obj.get('MESSAGE', '')
+        if isinstance(message, list):
+            message = ' '.join(str(b) for b in message)
+
+        pid_raw = obj.get('_PID')
+        pid = int(pid_raw) if pid_raw and str(pid_raw).isdigit() else None
+
+        entries.append(RawEntry(
+            timestamp=ts,
+            service=service,
+            priority=priority,
+            message=str(message).strip(),
+            source='journald',
+            hostname=obj.get('_HOSTNAME', ''),
+            pid=pid,
+        ))
+
+    return entries
+
+
+# ── /var/log file parsers ─────────────────────────────────────────────────────
+
+# Standard syslog line: "May 10 14:03:22 host service[pid]: message"
+_SYSLOG_RE = re.compile(
+    r'^(\w{3}\s+\d+\s[\d:]+)\s+(\S+)\s+(\S+?)(?:\[(\d+)\])?:\s+(.*)'
+)
+
+# ISO timestamp variant: "2026-05-10T14:03:22.123456+00:00 host service: msg"
+_ISO_SYSLOG_RE = re.compile(
+    r'^(\d{4}-\d{2}-\d{2}T[\d:.+]+)\s+(\S+)\s+(\S+?)(?:\[(\d+)\])?:\s+(.*)'
+)
+
+
+def _parse_syslog_ts(ts_str: str, year: int) -> Optional[datetime]:
+    ts_str = ts_str.strip()
+    for fmt in ('%b %d %H:%M:%S', '%b  %d %H:%M:%S'):
+        try:
+            dt = datetime.strptime(ts_str, fmt).replace(year=year)
+            return dt
+        except ValueError:
+            continue
+    return None
+
+
+def _parse_iso_ts(ts_str: str) -> Optional[datetime]:
+    ts_str = re.sub(r'([+-]\d{2}:\d{2})$', '', ts_str)
+    for fmt in ('%Y-%m-%dT%H:%M:%S.%f', '%Y-%m-%dT%H:%M:%S'):
+        try:
+            return datetime.strptime(ts_str, fmt)
+        except ValueError:
+            continue
+    return None
+
+
+def collect_logfile(path: str, since: datetime, until: datetime,
+                    source_label: str = 'syslog',
+                    default_priority: int = 3) -> List[RawEntry]:
+    """Parse a /var/log-style file and return entries in [since, until]."""
+    p = Path(path)
+    if not p.exists() or not p.is_file():
+        return []
+
+    entries = []
+    year = since.year
+
+    try:
+        with open(p, 'r', errors='replace') as fh:
+            for line in fh:
+                line = line.rstrip('\n')
+                ts = None
+                service = source_label
+                message = line
+                pid = None
+                hostname = ''
+
+                m = _SYSLOG_RE.match(line)
+                if m:
+                    ts = _parse_syslog_ts(m.group(1), year)
+                    hostname = m.group(2)
+                    service = m.group(3)
+                    pid = int(m.group(4)) if m.group(4) else None
+                    message = m.group(5)
+                else:
+                    m = _ISO_SYSLOG_RE.match(line)
+                    if m:
+                        ts = _parse_iso_ts(m.group(1))
+                        hostname = m.group(2)
+                        service = m.group(3)
+                        pid = int(m.group(4)) if m.group(4) else None
+                        message = m.group(5)
+
+                if ts is None or not (since <= ts <= until):
+                    continue
+
+                entries.append(RawEntry(
+                    timestamp=ts,
+                    service=service,
+                    priority=default_priority,
+                    message=message.strip(),
+                    source=source_label,
+                    hostname=hostname,
+                    pid=pid,
+                ))
+    except PermissionError:
+        pass
+
+    return entries
+
+
+# ── Main collection entry point ───────────────────────────────────────────────
+
+def collect_all(since: str, until: str,
+                units: List[str] = None,
+                include_files: bool = True,
+                priorities: str = '0..4') -> List[RawEntry]:
+    """
+    Collect from journalctl and optionally from /var/log files.
+    Returns a merged, time-sorted list of RawEntry.
+    """
+    since_dt = datetime.strptime(since, '%Y-%m-%d %H:%M')
+    until_dt = datetime.strptime(until, '%Y-%m-%d %H:%M')
+
+    entries = collect_journalctl(since, until, units, priorities)
+
+    if include_files:
+        log_files = [
+            ('/var/log/syslog',    'syslog',   4),
+            ('/var/log/messages',  'syslog',   4),
+            ('/var/log/auth.log',  'auth',     4),
+            ('/var/log/secure',    'auth',     4),
+            ('/var/log/kern.log',  'kernel',   3),
+            ('/var/log/dmesg',     'kernel',   3),
+        ]
+        seen_msgs: set = {e.message for e in entries}
+        for path, label, prio in log_files:
+            for entry in collect_logfile(path, since_dt, until_dt, label, prio):
+                if entry.message not in seen_msgs:
+                    entries.append(entry)
+                    seen_msgs.add(entry.message)
+
+    return sorted(entries, key=lambda e: e.timestamp)

syslog_postmortem/patterns.py

@@ -0,0 +1,108 @@
+"""
+Known error patterns with severity labels and action hints.
+Each pattern is matched against log message text.
+"""
+import re
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class Pattern:
+    name: str
+    regex: re.Pattern
+    severity: str       # CRITICAL | ERROR | WARNING
+    label: str          # human-readable category
+    action_hint: str    # suggested action item
+
+
+PATTERNS = [
+    Pattern(
+        name='oom',
+        regex=re.compile(r'out of memory|oom.kill|killed process|oom_reaper', re.I),
+        severity='CRITICAL',
+        label='OOM Killer',
+        action_hint='Investigate memory usage; consider adding swap or increasing RAM',
+    ),
+    Pattern(
+        name='disk_full',
+        regex=re.compile(r'no space left on device|disk full|filesystem.*full|write.*failed.*enospc', re.I),
+        severity='CRITICAL',
+        label='Disk Full',
+        action_hint='Free disk space immediately; review log rotation and data retention',
+    ),
+    Pattern(
+        name='kernel_oops',
+        regex=re.compile(r'kernel: bug|kernel: oops|kernel: warning.*call trace|segfault|general protection', re.I),
+        severity='CRITICAL',
+        label='Kernel Error',
+        action_hint='Review kernel logs; consider rebooting if system is unstable',
+    ),
+    Pattern(
+        name='service_failed',
+        regex=re.compile(r'\bfailed\b.*start|start.*\bfailed\b|unit.*entered failed|activating.*failed', re.I),
+        severity='ERROR',
+        label='Service Failed',
+        action_hint='Check service logs with journalctl -u <service>; review service configuration',
+    ),
+    Pattern(
+        name='service_crash',
+        regex=re.compile(r'segmentation fault|core dump|crashed|dumped core|aborted', re.I),
+        severity='ERROR',
+        label='Process Crash',
+        action_hint='Collect core dump; review application error logs',
+    ),
+    Pattern(
+        name='connection_refused',
+        regex=re.compile(r'connection refused|econnrefused|connect.*failed|upstream.*connect.*error', re.I),
+        severity='ERROR',
+        label='Connection Refused',
+        action_hint='Verify the downstream service is running and listening on the expected port',
+    ),
+    Pattern(
+        name='timeout',
+        regex=re.compile(r'\btimed? out\b|etimedout|operation timed out|request timeout|read timeout', re.I),
+        severity='WARNING',
+        label='Timeout',
+        action_hint='Check network latency and service response times; review timeout thresholds',
+    ),
+    Pattern(
+        name='auth_failure',
+        regex=re.compile(r'failed password|authentication failure|invalid user|permission denied.*ssh|pam.*auth.*fail', re.I),
+        severity='WARNING',
+        label='Auth Failure',
+        action_hint='Review SSH access logs; consider IP blocking if burst detected',
+    ),
+    Pattern(
+        name='service_restart',
+        regex=re.compile(r'start request repeated too quickly|restarting.*unit|automatic.*restart', re.I),
+        severity='WARNING',
+        label='Service Restart Loop',
+        action_hint='Service is crash-looping; check dependencies and configuration',
+    ),
+    Pattern(
+        name='ssl_cert',
+        regex=re.compile(r'certificate.*expir|ssl.*error|tls.*handshake.*fail|certificate verify failed', re.I),
+        severity='ERROR',
+        label='SSL/TLS Error',
+        action_hint='Renew the certificate; check certificate chain and validity',
+    ),
+    Pattern(
+        name='db_error',
+        regex=re.compile(r'could not connect.*database|database.*unavailable|max.*connection.*reached|deadlock', re.I),
+        severity='ERROR',
+        label='Database Error',
+        action_hint='Check database service status, connection pool settings, and max connections',
+    ),
+    Pattern(
+        name='high_load',
+        regex=re.compile(r'load average.*\b([5-9]\d|\d{2,})\b|cpu.*throttl|system.*overload', re.I),
+        severity='WARNING',
+        label='High System Load',
+        action_hint='Identify CPU-intensive processes; consider horizontal scaling',
+    ),
+]
+
+
+def match_patterns(message: str) -> list:
+    """Return list of matching Patterns for a log message."""
+    return [p for p in PATTERNS if p.regex.search(message)]

syslog_postmortem/renderer.py

@@ -0,0 +1,284 @@
+"""
+Render an AnalysisResult to Markdown or HTML.
+"""
+from datetime import datetime
+from typing import Optional
+
+from .analyzer import AnalysisResult, Event
+
+VERSION = "1.0.0"
+
+_SEV_ICON = {
+    'CRITICAL': '⛔',
+    'ERROR':    '🔴',
+    'WARNING':  '⚠️',
+    'INFO':     'ℹ️',
+    'DEBUG':    '🔵',
+}
+
+_SEV_ORDER = ['CRITICAL', 'ERROR', 'WARNING', 'INFO', 'DEBUG']
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+def _ts(dt: datetime) -> str:
+    return dt.strftime('%H:%M:%S')
+
+
+def _md_escape(s: str) -> str:
+    return s.replace('|', '\\|').replace('`', "'")
+
+
+def _duration(since: str, until: str) -> str:
+    fmt = '%Y-%m-%d %H:%M'
+    try:
+        delta = datetime.strptime(until, fmt) - datetime.strptime(since, fmt)
+        h, rem = divmod(int(delta.total_seconds()), 3600)
+        m = rem // 60
+        parts = []
+        if h:
+            parts.append(f"{h}h")
+        if m:
+            parts.append(f"{m}m")
+        return ' '.join(parts) or '< 1m'
+    except ValueError:
+        return 'unknown'
+
+
+def _overall_severity(result: AnalysisResult) -> str:
+    if result.by_severity.get('CRITICAL'):
+        return 'Critical'
+    if result.by_severity.get('ERROR'):
+        return 'High'
+    if result.by_severity.get('WARNING'):
+        return 'Medium'
+    return 'Low'
+
+
+# ── Markdown renderer ─────────────────────────────────────────────────────────
+
+def render_markdown(result: AnalysisResult, title: str,
+                    since: str, until: str,
+                    services: Optional[list] = None) -> str:
+    lines = []
+    date_str = since.split()[0]
+    duration = _duration(since, until)
+    severity_label = _overall_severity(result)
+    affected_str = ', '.join(f'`{s}`' for s in result.services_affected) or '_none detected_'
+
+    # ── Header ─────────────────────────────────────────────────────────────────
+    lines += [
+        f"# Postmortem: {title}",
+        "",
+        f"| | |",
+        f"|---|---|",
+        f"| **Date** | {date_str} |",
+        f"| **Window** | {since} → {until} |",
+        f"| **Duration** | {duration} |",
+        f"| **Severity** | {severity_label} |",
+        f"| **Status** | Draft |",
+        f"| **Services affected** | {affected_str} |",
+        "",
+        "---",
+        "",
+    ]
+
+    # ── Summary ────────────────────────────────────────────────────────────────
+    lines += ["## Summary", ""]
+    total_errors = len(result.by_severity.get('CRITICAL', [])) + \
+                   len(result.by_severity.get('ERROR', []))
+    total_events = len(result.timeline)
+
+    summary_parts = [
+        f"Analysis of **{result.total_raw} raw log entries** "
+        f"({total_events} unique events after deduplication) "
+        f"across **{len(result.by_service)} services**."
+    ]
+    if result.first_anomaly:
+        summary_parts.append(
+            f"First anomaly detected at **{_ts(result.first_anomaly.timestamp)}** "
+            f"in **`{result.first_anomaly.service}`** "
+            f"({result.first_anomaly.severity})."
+        )
+    if result.peak_window:
+        summary_parts.append(
+            f"Highest error density at **{result.peak_window.strftime('%H:%M')}**."
+        )
+    lines += [' '.join(summary_parts), "", "> *Auto-generated draft — review all sections before sharing.*", "", "---", ""]
+
+    # ── Timeline ───────────────────────────────────────────────────────────────
+    lines += ["## Timeline", ""]
+    show = [e for e in result.timeline if e.severity in ('CRITICAL', 'ERROR', 'WARNING')][:50]
+    if show:
+        lines += [
+            "| Time | Service | Severity | Event |",
+            "|------|---------|----------|-------|",
+        ]
+        for ev in show:
+            icon = _SEV_ICON.get(ev.severity, '')
+            svc = f"`{ev.service}`"
+            sev = f"{icon} {ev.severity}"
+            msg = _md_escape(ev.message[:100])
+            cnt = f" _(×{ev.count})_" if ev.count > 1 else ""
+            lines.append(f"| {_ts(ev.timestamp)} | {svc} | {sev} | {msg}{cnt} |")
+        if len([e for e in result.timeline if e.severity in ('CRITICAL', 'ERROR', 'WARNING')]) > 50:
+            lines.append(f"\n_Table truncated to 50 entries. Full list in error sections below._")
+    else:
+        lines.append("_No warnings or errors found in the specified window._")
+    lines += ["", "---", ""]
+
+    # ── Errors by severity ─────────────────────────────────────────────────────
+    lines += ["## Events by Severity", ""]
+    for sev in _SEV_ORDER:
+        evs = result.by_severity.get(sev, [])
+        if not evs:
+            continue
+        icon = _SEV_ICON.get(sev, '')
+        lines += [f"### {icon} {sev} ({len(evs)} event{'s' if len(evs) != 1 else ''})", ""]
+        for ev in evs[:30]:
+            cnt = f" _(×{ev.count})_" if ev.count > 1 else ""
+            patterns = ""
+            if ev.patterns:
+                patterns = " `[" + ", ".join(p.label for p in ev.patterns) + "]`"
+            lines.append(
+                f"- `[{_ts(ev.timestamp)}]` **{ev.service}** — "
+                f"{_md_escape(ev.message[:120])}{cnt}{patterns}"
+            )
+        if len(evs) > 30:
+            lines.append(f"\n_...and {len(evs) - 30} more {sev} events._")
+        lines.append("")
+    lines += ["---", ""]
+
+    # ── Pattern summary ────────────────────────────────────────────────────────
+    if result.pattern_counts:
+        lines += ["## Pattern Analysis", "",
+                  "| Pattern | Occurrences | Affected services |",
+                  "|---------|-------------|-------------------|"]
+        from .patterns import PATTERNS
+        pmap = {p.name: p for p in PATTERNS}
+        for name, count in sorted(result.pattern_counts.items(), key=lambda x: -x[1]):
+            pat = pmap.get(name)
+            label = pat.label if pat else name
+            svcs = sorted({
+                e.service for e in result.timeline
+                if any(p.name == name for p in e.patterns)
+            })
+            svc_str = ', '.join(f'`{s}`' for s in svcs[:5])
+            if len(svcs) > 5:
+                svc_str += f' +{len(svcs)-5} more'
+            lines.append(f"| {label} | {count} | {svc_str} |")
+        lines += ["", "---", ""]
+
+    # ── Contributing factors ───────────────────────────────────────────────────
+    lines += [
+        "## Contributing Factors",
+        "",
+        "> *Auto-detected from log patterns — verify each before including in final report.*",
+        "",
+    ]
+    for f in result.contributing_factors:
+        lines.append(f"- {f}")
+    lines += ["", "---", ""]
+
+    # ── Impact ─────────────────────────────────────────────────────────────────
+    lines += [
+        "## Impact Assessment",
+        "",
+        "<!-- Fill in manually -->",
+        "",
+        f"- **Affected services:** {affected_str}",
+        "- **Affected users:** ",
+        "- **Data loss:** ",
+        "- **Downtime:** ",
+        "- **Revenue impact:** ",
+        "",
+        "---",
+        "",
+    ]
+
+    # ── Root cause ─────────────────────────────────────────────────────────────
+    lines += [
+        "## Root Cause Analysis",
+        "",
+        "<!-- Fill in manually after investigation -->",
+        "",
+        "### What happened?",
+        "",
+        "### Why did it happen?",
+        "",
+        "### Why wasn't it caught earlier?",
+        "",
+        "---",
+        "",
+    ]
+
+    # ── Action items ───────────────────────────────────────────────────────────
+    lines += ["## Action Items", ""]
+    if result.action_items:
+        lines.append("_Generated from detected patterns — assign owner and priority._")
+        lines.append("")
+        for item in result.action_items:
+            lines.append(f"- [ ] {item}")
+    else:
+        lines.append("- [ ] ")
+    lines += ["", "---", ""]
+
+    # ── Lessons learned ────────────────────────────────────────────────────────
+    lines += [
+        "## Lessons Learned",
+        "",
+        "<!-- Fill in manually -->",
+        "",
+        "---",
+        "",
+        f"*Generated by [syslog-postmortem](https://github.com/serber1990/syslog-postmortem) "
+        f"v{VERSION} at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}*",
+    ]
+
+    return '\n'.join(lines)
+
+
+# ── HTML renderer ─────────────────────────────────────────────────────────────
+
+def render_html(md: str, title: str) -> str:
+    """Wrap Markdown in a minimal HTML shell with inline CSS."""
+    css = """
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+           max-width: 960px; margin: 40px auto; padding: 0 20px; color: #24292e; }
+    h1 { border-bottom: 2px solid #e1e4e8; padding-bottom: 12px; }
+    h2 { border-bottom: 1px solid #e1e4e8; padding-bottom: 8px; margin-top: 32px; }
+    table { border-collapse: collapse; width: 100%; margin: 16px 0; }
+    th { background: #f6f8fa; text-align: left; }
+    th, td { border: 1px solid #e1e4e8; padding: 8px 12px; font-size: 14px; }
+    tr:nth-child(even) { background: #f6f8fa; }
+    code { background: #f6f8fa; border-radius: 3px; padding: 2px 5px; font-size: 90%; }
+    blockquote { border-left: 4px solid #e1e4e8; margin: 0; padding: 8px 16px; color: #6a737d; }
+    pre { background: #f6f8fa; padding: 16px; border-radius: 6px; overflow-x: auto; }
+    li { margin: 4px 0; }
+    """
+    # Minimal Markdown → HTML (just enough for our output)
+    import re as _re
+    html = md
+    html = _re.sub(r'^# (.+)$', r'<h1>\1</h1>', html, flags=_re.M)
+    html = _re.sub(r'^## (.+)$', r'<h2>\1</h2>', html, flags=_re.M)
+    html = _re.sub(r'^### (.+)$', r'<h3>\1</h3>', html, flags=_re.M)
+    html = _re.sub(r'\*\*(.+?)\*\*', r'<strong>\1</strong>', html)
+    html = _re.sub(r'`(.+?)`', r'<code>\1</code>', html)
+    html = _re.sub(r'^- \[ \] (.+)$', r'<li>☐ \1</li>', html, flags=_re.M)
+    html = _re.sub(r'^- (.+)$', r'<li>\1</li>', html, flags=_re.M)
+    html = _re.sub(r'^---$', r'<hr>', html, flags=_re.M)
+    html = html.replace('\n', '<br>\n')
+
+    return f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>{title}</title>
+  <style>{css}</style>
+</head>
+<body>
+{html}
+</body>
+</html>
+"""

syslog_postmortem-1.0.0.dist-info/METADATA

@@ -0,0 +1,149 @@
+Metadata-Version: 2.4
+Name: syslog-postmortem
+Version: 1.0.0
+Summary: Generate structured postmortem drafts from journalctl, syslog, auth.log and dmesg
+Author-email: Serber1990 <serber1990@pm.me>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/serber1990/syslog-postmortem
+Project-URL: Bug Tracker, https://github.com/serber1990/syslog-postmortem/issues
+Project-URL: Source Code, https://github.com/serber1990/syslog-postmortem
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Environment :: Console
+Classifier: Topic :: System :: Logging
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: shellcolorize
+Dynamic: license-file
+
+# syslog-postmortem
+
+[![PyPI version](https://badge.fury.io/py/syslog-postmortem.svg)](https://badge.fury.io/py/syslog-postmortem)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)
+
+Generate a **structured postmortem draft** from system logs in seconds — no more reconstructing incident timelines by hand.
+
+Pulls from `journalctl`, `/var/log/syslog`, `/var/log/auth.log` and `/var/log/dmesg`, correlates events, detects patterns, and produces a ready-to-edit Markdown or HTML postmortem.
+
+---
+
+## ✨ What it does
+
+Given a time window and optional service list, `syslog-postmortem`:
+
+1. **Collects** entries from `journalctl` (primary) and `/var/log` files (supplement)
+2. **Deduplicates** repeated messages and counts occurrences
+3. **Detects patterns** — OOM kills, service crashes, auth bursts, disk exhaustion, cascading failures, connection errors
+4. **Builds a timeline** sorted chronologically with severity icons
+5. **Identifies contributing factors** automatically (restart loops, cascade chains, error bursts)
+6. **Generates action items** from pattern hints
+7. **Outputs** a complete Markdown postmortem ready to edit and share
+
+---
+
+## 📥 Installation
+
+```bash
+pip install syslog-postmortem
+```
+
+---
+
+## 🛠 Usage
+
+```bash
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00"
+```
+
+```bash
+# Focus on specific services
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00" \
+           --services nginx,postgresql,redis \
+           --title "Database outage" \
+           --output incident-2026-05-10.md
+
+# HTML output
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00" \
+           --format html --output report.html
+
+# journalctl only (skip /var/log files)
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00" --no-files
+```
+
+---
+
+## 📋 Options
+
+| Option | Description |
+|--------|-------------|
+| `--from DATETIME` | Start of incident window **required** |
+| `--to DATETIME` | End of incident window **required** |
+| `--title TEXT` | Postmortem title (default: `Incident YYYY-MM-DD`) |
+| `--services LIST` | Comma-separated services to focus on |
+| `--output FILE` | Output path (default: `postmortem_YYYYMMDD_HHMM.md`) |
+| `--format` | `markdown` (default) or `html` |
+| `--no-files` | Skip `/var/log` parsing, use journalctl only |
+| `--priorities` | journalctl priority filter (default: `0..4`) |
+
+---
+
+## 📄 Output structure
+
+```markdown
+# Postmortem: Database outage
+
+| | |
+|---|---|
+| **Date** | 2026-05-10 |
+| **Window** | 2026-05-10 14:00 → 2026-05-10 16:00 |
+| **Duration** | 2h 0m |
+| **Severity** | Critical |
+
+## Summary
+Analysis of 1,243 raw log entries (89 unique events after deduplication)...
+First anomaly detected at **14:03:22** in **postgresql** (CRITICAL).
+
+## Timeline
+| Time | Service | Severity | Event |
+|------|---------|----------|-------|
+| 14:03:22 | `postgresql` | ⛔ CRITICAL | could not connect to server |
+| 14:03:45 | `nginx` | 🔴 ERROR | upstream connect error |
+
+## Contributing Factors
+- **Service instability**: `postgresql` triggered restart-loop detection 4 time(s)
+- **Cascading failure**: `nginx` errors began 23s after first `postgresql` critical event
+
+## Action Items
+- [ ] Investigate postgresql restart cause; check dependencies and configuration
+- [ ] Verify the downstream service is running and listening on the expected port
+```
+
+---
+
+## 🔍 Detected patterns
+
+| Pattern | Triggers |
+|---------|----------|
+| OOM Killer | `out of memory`, `oom_kill`, `killed process` |
+| Disk Full | `no space left on device`, `disk full` |
+| Kernel Error | `kernel: BUG`, `segfault`, `general protection` |
+| Service Failed | `failed to start`, `unit entered failed state` |
+| Process Crash | `segmentation fault`, `core dump`, `aborted` |
+| Connection Refused | `connection refused`, `upstream connect error` |
+| Timeout | `timed out`, `ETIMEDOUT`, `request timeout` |
+| Auth Failure | `Failed password`, `authentication failure`, `invalid user` |
+| SSL/TLS Error | `certificate expired`, `TLS handshake failed` |
+| Database Error | `could not connect to database`, `max connections reached` |
+| High Load | `load average` spike, `cpu throttled` |
+
+---
+
+## 📝 License
+
+MIT — see [LICENSE](LICENSE).
+
+## 🌐 Connect
+
+[![GitHub](https://img.shields.io/badge/GitHub-@serber1990-181717?style=flat-square&logo=github)](https://github.com/serber1990)

syslog_postmortem-1.0.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+syslog_postmortem/__init__.py,sha256=J4ZAkuqeqNK6dDc8PUWN8zxZ4lZX1Kuaqo3ErNNwtPg,64
+syslog_postmortem/analyzer.py,sha256=D1A2iYVyt5OSu2VUM_Wyy4p-CkOnG2eRCmhlfyUCWu4,8368
+syslog_postmortem/cli.py,sha256=m_J17cLIOZZJWB7ocC_Q9sbs38aDAdgVkCOXeegPuOw,6697
+syslog_postmortem/collector.py,sha256=D0zx5jtHjz4iuY1WBa49pv-gePwnlzEpFD6MFMYVWMc,7736
+syslog_postmortem/patterns.py,sha256=oYoZ0qoh9f1AG3Tl7g15tGDXRhYjDsHOKmrKoP8_vIg,4224
+syslog_postmortem/renderer.py,sha256=-JkXSeAV4VMyOQr1annSLWLL3_AV6yyJf-XVS8levSU,11796
+syslog_postmortem-1.0.0.dist-info/licenses/LICENSE,sha256=rOAaRlMktc-uI4u5mxNvBLTLqUvsyujBQMivrLv2olo,1067
+syslog_postmortem-1.0.0.dist-info/METADATA,sha256=hwNe1dfJBxNWKKVSnY9DJj3bfx4vIZ3BXQIIYfXbbzg,5214
+syslog_postmortem-1.0.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+syslog_postmortem-1.0.0.dist-info/entry_points.txt,sha256=pbDocgiS1s8q2SNCytQ7_r17-IwxEn_ckFYySDv7FFs,58
+syslog_postmortem-1.0.0.dist-info/top_level.txt,sha256=L1LckoKPgMN0O1vrWN546Pj8KEs3lVuiItsP1GyGL2c,18
+syslog_postmortem-1.0.0.dist-info/RECORD,,

syslog_postmortem-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

syslog_postmortem-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+postmortem = syslog_postmortem.cli:main

syslog_postmortem-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Serber1990
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

syslog_postmortem-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+syslog_postmortem