syslog-postmortem 1.0.0__tar.gz → 1.1.0__tar.gz

syslog_postmortem-1.1.0/PKG-INFO

@@ -0,0 +1,205 @@
+Metadata-Version: 2.4
+Name: syslog-postmortem
+Version: 1.1.0
+Summary: Generate structured postmortem drafts from journalctl, syslog, auth.log and kern.log
+Author-email: Serber1990 <serber1990@pm.me>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/serber1990/syslog-postmortem
+Project-URL: Bug Tracker, https://github.com/serber1990/syslog-postmortem/issues
+Project-URL: Source Code, https://github.com/serber1990/syslog-postmortem
+Project-URL: Changelog, https://github.com/serber1990/syslog-postmortem/blob/main/CHANGELOG.md
+Keywords: postmortem,incident,sre,journalctl,syslog,logs,sysadmin
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: System :: Logging
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: shellcolorize>=1.1.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Dynamic: license-file
+
+# syslog-postmortem
+
+[![CI](https://github.com/serber1990/syslog-postmortem/actions/workflows/ci.yml/badge.svg)](https://github.com/serber1990/syslog-postmortem/actions/workflows/ci.yml)
+[![PyPI version](https://badge.fury.io/py/syslog-postmortem.svg)](https://badge.fury.io/py/syslog-postmortem)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+
+Generate a **structured postmortem draft** from system logs in seconds — no more reconstructing incident
+timelines by hand at 3 a.m.
+
+Reads `journalctl` plus `/var/log/syslog`, `messages`, `auth.log`, `secure` and `kern.log`, correlates
+events, detects known failure patterns and writes a ready-to-edit Markdown or HTML postmortem.
+
+---
+
+## ✨ What it does
+
+Given a time window (and optionally a list of services), `postmortem`:
+
+1. **Collects** entries from `journalctl` (primary) and `/var/log` files, including their `.1` rotation
+2. **Attributes** systemd messages to the unit they are about (not to PID 1)
+3. **Groups** repeated messages — `Failed to start backup (×166, until 10:55)` instead of 166 lines
+4. **Detects patterns** — OOM kills, disk full, kernel oops, crashes, restart loops, connection errors,
+   timeouts, auth bursts, TLS and database errors, high load
+5. **Builds a timeline**, keeping the most severe events when there are too many
+6. **Finds contributing factors** — cascading failures between services, restart loops, error bursts
+7. **Suggests action items** and leaves Impact / Root cause / Lessons learned sections ready to fill in
+
+---
+
+## 📥 Installation
+
+```bash
+pip install syslog-postmortem
+```
+
+Run it with `sudo` (or as a member of the `adm` / `systemd-journal` group) to read the whole system journal.
+
+---
+
+## 🛠 Usage
+
+```bash
+postmortem --last 2h                                   # incident in progress: the last two hours
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00"
+```
+
+```bash
+# Focus on specific services (postgresql also matches postgresql@14-main)
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00" \
+           --services nginx,postgresql,redis \
+           --title "Database outage" \
+           --output incident-2026-05-10.md
+
+# Standalone HTML page (light/dark theme, safe to open: log content is escaped)
+postmortem --last 1d --format html --output report.html
+
+# Print to stdout, e.g. to paste into a ticket
+postmortem --last 30m -o - | xclip -selection clipboard
+```
+
+---
+
+## 📋 Options
+
+| Option | Description |
+|--------|-------------|
+| `--from DATETIME` | Start of the window: `"YYYY-MM-DD HH:MM[:SS]"` |
+| `--to DATETIME` | End of the window (default: now) |
+| `--last DURATION` | Window ending now (or at `--to`): `30m`, `2h`, `1d` |
+| `--title TEXT` | Postmortem title (default: `Incident YYYY-MM-DD`) |
+| `--services LIST` | Comma-separated services to focus on |
+| `-o`, `--output FILE` | Output path (default: `postmortem_YYYYMMDD_HHMM.md`); `-` for stdout |
+| `--format` | `markdown` (default) or `html` |
+| `--no-files` | Skip `/var/log` files, use journalctl only |
+| `--priorities` | journalctl priority filter (default: `0..4` = emerg…warning) |
+
+---
+
+## 📄 Example
+
+This draft was generated from a simulated incident: PostgreSQL is OOM-killed, nginx starts failing,
+and someone tries to brute-force SSH at the same time.
+
+```markdown
+# Postmortem: Database outage
+
+| | |
+|---|---|
+| **Date** | 2026-05-10 |
+| **Window** | 2026-05-10 14:00 → 2026-05-10 16:00 |
+| **Duration** | 2h |
+| **Severity** | Critical |
+| **Status** | Draft |
+| **Services analysed** | all |
+| **Services affected** | `kernel`, `nginx`, `postgresql` |
+
+---
+
+## Summary
+
+Analysis of **58 raw log entries** (5 unique events after deduplication) across **4 services**. First anomaly detected at **14:03:22** in `kernel` (CRITICAL). Highest error density at **14:03**.
+
+> *Auto-generated draft — review all sections before sharing.*
+
+---
+
+## Timeline
+
+| Time | Service | Severity | Event |
+|------|---------|----------|-------|
+| 14:03:22 | `kernel` | ⛔ CRITICAL | Out of memory: Killed process 2211 (postgres) total-vm:8123456kB |
+| 14:03:24 | `postgresql` | ⛔ CRITICAL | server process (PID 2211) was terminated by signal 9: Killed |
+| 14:03:45 | `nginx` | 🔴 ERROR | connect() failed (111: Connection refused) while connecting to upstream _(×40, until 14:05:42)_ |
+| 14:04:22 | `postgresql` | ⚠️ WARNING | start request repeated too quickly, automatic restart _(×4, until 14:05:22)_ |
+| 14:08:22 | `sshd` | ⚠️ WARNING | Failed password for invalid user admin from 203.0.113.7 port 40000 _(×12, until 14:08:33)_ |
+
+## Contributing Factors
+
+> *Auto-detected from log patterns — verify each before including in final report.*
+
+- **Service instability**: `postgresql` triggered restart-loop detection **4 time(s)**
+- **Memory pressure**: OOM killer fired **1 time(s)** during the window
+- **Auth anomaly**: Burst of **12 authentication failure(s)** detected — possible brute-force attempt
+- **Cascading failure**: `nginx` errors began **23s** after the first `kernel` critical event (14:03:22)
+- **Cascading failure**: `nginx` errors began **21s** after the first `postgresql` critical event (14:03:24)
+- **Error burst**: **42 errors** in the 5-minute window starting 14:00
+
+## Action Items
+
+_Generated from detected patterns — assign owner and priority._
+
+- [ ] Investigate memory usage; consider adding swap or increasing RAM
+- [ ] Verify the downstream service is running and listening on the expected port
+- [ ] Service is crash-looping; check dependencies and configuration
+- [ ] Review SSH access logs; consider IP blocking if burst detected
+
+…
+```
+
+---
+
+## 🔍 Detected patterns
+
+| Pattern | Triggers |
+|---------|----------|
+| OOM Killer | `out of memory`, `oom-kill`, `killed process` |
+| Disk Full | `no space left on device`, `disk full` |
+| Kernel Error | `BUG:`, `Oops`, `call trace`, `segfault at`, `general protection`, `kernel panic` |
+| Service Failed | `failed to start`, `entered failed state` |
+| Process Crash | `segmentation fault`, `core dumped`, `aborted` |
+| Connection Refused | `connection refused`, `upstream connect error` |
+| Timeout | `timed out`, `ETIMEDOUT`, `request timeout` |
+| Auth Failure | `Failed password`, `authentication failure`, `invalid user` |
+| Service Restart Loop | `start request repeated too quickly`, `automatic restart` |
+| SSL/TLS Error | `certificate expired`, `TLS handshake failed`, `certificate verify failed` |
+| Database Error | `could not connect to database`, `max connections reached`, `deadlock` |
+| High Load | load average of 10 or more, `cpu throttled` |
+
+---
+
+## 🧪 Development
+
+```bash
+pip install -e ".[dev]"
+ruff check .
+pytest
+```
+
+See [CHANGELOG.md](CHANGELOG.md) for release notes.
+
+---
+
+## 📝 License
+
+MIT — see [LICENSE](LICENSE).
+
+## 🌐 Connect
+
+[![GitHub](https://img.shields.io/badge/GitHub-@serber1990-181717?style=flat-square&logo=github)](https://github.com/serber1990)

syslog_postmortem-1.1.0/README.md

@@ -0,0 +1,179 @@
+# syslog-postmortem
+
+[![CI](https://github.com/serber1990/syslog-postmortem/actions/workflows/ci.yml/badge.svg)](https://github.com/serber1990/syslog-postmortem/actions/workflows/ci.yml)
+[![PyPI version](https://badge.fury.io/py/syslog-postmortem.svg)](https://badge.fury.io/py/syslog-postmortem)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+
+Generate a **structured postmortem draft** from system logs in seconds — no more reconstructing incident
+timelines by hand at 3 a.m.
+
+Reads `journalctl` plus `/var/log/syslog`, `messages`, `auth.log`, `secure` and `kern.log`, correlates
+events, detects known failure patterns and writes a ready-to-edit Markdown or HTML postmortem.
+
+---
+
+## ✨ What it does
+
+Given a time window (and optionally a list of services), `postmortem`:
+
+1. **Collects** entries from `journalctl` (primary) and `/var/log` files, including their `.1` rotation
+2. **Attributes** systemd messages to the unit they are about (not to PID 1)
+3. **Groups** repeated messages — `Failed to start backup (×166, until 10:55)` instead of 166 lines
+4. **Detects patterns** — OOM kills, disk full, kernel oops, crashes, restart loops, connection errors,
+   timeouts, auth bursts, TLS and database errors, high load
+5. **Builds a timeline**, keeping the most severe events when there are too many
+6. **Finds contributing factors** — cascading failures between services, restart loops, error bursts
+7. **Suggests action items** and leaves Impact / Root cause / Lessons learned sections ready to fill in
+
+---
+
+## 📥 Installation
+
+```bash
+pip install syslog-postmortem
+```
+
+Run it with `sudo` (or as a member of the `adm` / `systemd-journal` group) to read the whole system journal.
+
+---
+
+## 🛠 Usage
+
+```bash
+postmortem --last 2h                                   # incident in progress: the last two hours
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00"
+```
+
+```bash
+# Focus on specific services (postgresql also matches postgresql@14-main)
+postmortem --from "2026-05-10 14:00" --to "2026-05-10 16:00" \
+           --services nginx,postgresql,redis \
+           --title "Database outage" \
+           --output incident-2026-05-10.md
+
+# Standalone HTML page (light/dark theme, safe to open: log content is escaped)
+postmortem --last 1d --format html --output report.html
+
+# Print to stdout, e.g. to paste into a ticket
+postmortem --last 30m -o - | xclip -selection clipboard
+```
+
+---
+
+## 📋 Options
+
+| Option | Description |
+|--------|-------------|
+| `--from DATETIME` | Start of the window: `"YYYY-MM-DD HH:MM[:SS]"` |
+| `--to DATETIME` | End of the window (default: now) |
+| `--last DURATION` | Window ending now (or at `--to`): `30m`, `2h`, `1d` |
+| `--title TEXT` | Postmortem title (default: `Incident YYYY-MM-DD`) |
+| `--services LIST` | Comma-separated services to focus on |
+| `-o`, `--output FILE` | Output path (default: `postmortem_YYYYMMDD_HHMM.md`); `-` for stdout |
+| `--format` | `markdown` (default) or `html` |
+| `--no-files` | Skip `/var/log` files, use journalctl only |
+| `--priorities` | journalctl priority filter (default: `0..4` = emerg…warning) |
+
+---
+
+## 📄 Example
+
+This draft was generated from a simulated incident: PostgreSQL is OOM-killed, nginx starts failing,
+and someone tries to brute-force SSH at the same time.
+
+```markdown
+# Postmortem: Database outage
+
+| | |
+|---|---|
+| **Date** | 2026-05-10 |
+| **Window** | 2026-05-10 14:00 → 2026-05-10 16:00 |
+| **Duration** | 2h |
+| **Severity** | Critical |
+| **Status** | Draft |
+| **Services analysed** | all |
+| **Services affected** | `kernel`, `nginx`, `postgresql` |
+
+---
+
+## Summary
+
+Analysis of **58 raw log entries** (5 unique events after deduplication) across **4 services**. First anomaly detected at **14:03:22** in `kernel` (CRITICAL). Highest error density at **14:03**.
+
+> *Auto-generated draft — review all sections before sharing.*
+
+---
+
+## Timeline
+
+| Time | Service | Severity | Event |
+|------|---------|----------|-------|
+| 14:03:22 | `kernel` | ⛔ CRITICAL | Out of memory: Killed process 2211 (postgres) total-vm:8123456kB |
+| 14:03:24 | `postgresql` | ⛔ CRITICAL | server process (PID 2211) was terminated by signal 9: Killed |
+| 14:03:45 | `nginx` | 🔴 ERROR | connect() failed (111: Connection refused) while connecting to upstream _(×40, until 14:05:42)_ |
+| 14:04:22 | `postgresql` | ⚠️ WARNING | start request repeated too quickly, automatic restart _(×4, until 14:05:22)_ |
+| 14:08:22 | `sshd` | ⚠️ WARNING | Failed password for invalid user admin from 203.0.113.7 port 40000 _(×12, until 14:08:33)_ |
+
+## Contributing Factors
+
+> *Auto-detected from log patterns — verify each before including in final report.*
+
+- **Service instability**: `postgresql` triggered restart-loop detection **4 time(s)**
+- **Memory pressure**: OOM killer fired **1 time(s)** during the window
+- **Auth anomaly**: Burst of **12 authentication failure(s)** detected — possible brute-force attempt
+- **Cascading failure**: `nginx` errors began **23s** after the first `kernel` critical event (14:03:22)
+- **Cascading failure**: `nginx` errors began **21s** after the first `postgresql` critical event (14:03:24)
+- **Error burst**: **42 errors** in the 5-minute window starting 14:00
+
+## Action Items
+
+_Generated from detected patterns — assign owner and priority._
+
+- [ ] Investigate memory usage; consider adding swap or increasing RAM
+- [ ] Verify the downstream service is running and listening on the expected port
+- [ ] Service is crash-looping; check dependencies and configuration
+- [ ] Review SSH access logs; consider IP blocking if burst detected
+
+…
+```
+
+---
+
+## 🔍 Detected patterns
+
+| Pattern | Triggers |
+|---------|----------|
+| OOM Killer | `out of memory`, `oom-kill`, `killed process` |
+| Disk Full | `no space left on device`, `disk full` |
+| Kernel Error | `BUG:`, `Oops`, `call trace`, `segfault at`, `general protection`, `kernel panic` |
+| Service Failed | `failed to start`, `entered failed state` |
+| Process Crash | `segmentation fault`, `core dumped`, `aborted` |
+| Connection Refused | `connection refused`, `upstream connect error` |
+| Timeout | `timed out`, `ETIMEDOUT`, `request timeout` |
+| Auth Failure | `Failed password`, `authentication failure`, `invalid user` |
+| Service Restart Loop | `start request repeated too quickly`, `automatic restart` |
+| SSL/TLS Error | `certificate expired`, `TLS handshake failed`, `certificate verify failed` |
+| Database Error | `could not connect to database`, `max connections reached`, `deadlock` |
+| High Load | load average of 10 or more, `cpu throttled` |
+
+---
+
+## 🧪 Development
+
+```bash
+pip install -e ".[dev]"
+ruff check .
+pytest
+```
+
+See [CHANGELOG.md](CHANGELOG.md) for release notes.
+
+---
+
+## 📝 License
+
+MIT — see [LICENSE](LICENSE).
+
+## 🌐 Connect
+
+[![GitHub](https://img.shields.io/badge/GitHub-@serber1990-181717?style=flat-square&logo=github)](https://github.com/serber1990)

{syslog_postmortem-1.0.0 → syslog_postmortem-1.1.0}/pyproject.toml

@@ -1,32 +1,51 @@
 [build-system]
-requires = ["setuptools>=61", "wheel"]
+requires = ["setuptools>=77"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "syslog-postmortem"
-version = "1.0.0"
-description = "Generate structured postmortem drafts from journalctl, syslog, auth.log and dmesg"
+dynamic = ["version"]
+description = "Generate structured postmortem drafts from journalctl, syslog, auth.log and kern.log"
 readme = "README.md"
 license = "MIT"
+license-files = ["LICENSE"]
 authors = [{ name = "Serber1990", email = "serber1990@pm.me" }]
-requires-python = ">=3.8"
-dependencies = ["shellcolorize"]
+requires-python = ">=3.9"
+dependencies = ["shellcolorize>=1.1.0"]
+keywords = ["postmortem", "incident", "sre", "journalctl", "syslog", "logs", "sysadmin"]
 classifiers = [
     "Programming Language :: Python :: 3",
     "Operating System :: POSIX :: Linux",
     "Environment :: Console",
+    "Intended Audience :: System Administrators",
     "Topic :: System :: Logging",
     "Topic :: System :: Systems Administration",
 ]
 
+[project.optional-dependencies]
+dev = ["pytest>=7", "ruff>=0.4"]
+
 [project.urls]
 Homepage     = "https://github.com/serber1990/syslog-postmortem"
 "Bug Tracker" = "https://github.com/serber1990/syslog-postmortem/issues"
 "Source Code" = "https://github.com/serber1990/syslog-postmortem"
+Changelog    = "https://github.com/serber1990/syslog-postmortem/blob/main/CHANGELOG.md"
 
 [project.scripts]
 postmortem = "syslog_postmortem.cli:main"
 
 [tool.setuptools.packages.find]
-where = ["."]
 include = ["syslog_postmortem*"]
+
+[tool.setuptools.dynamic]
+version = { attr = "syslog_postmortem.__version__" }
+
+[tool.pytest.ini_options]
+pythonpath = ["."]
+filterwarnings = ["error::DeprecationWarning"]
+
+[tool.ruff]
+target-version = "py39"
+
+[tool.ruff.lint]
+select = ["E9", "F", "B"]

syslog_postmortem-1.1.0/syslog_postmortem/__init__.py

@@ -0,0 +1,5 @@
+__version__ = "1.1.0"
+
+from .cli import main  # noqa: E402  (after __version__: cli imports it)
+
+__all__ = ["main", "__version__"]

syslog_postmortem-1.1.0/syslog_postmortem/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+main()

{syslog_postmortem-1.0.0 → syslog_postmortem-1.1.0}/syslog_postmortem/analyzer.py

@@ -1,10 +1,11 @@
 """
 Pattern analysis, deduplication, cascade detection and contributing factor generation.
 """
+import re
 from collections import Counter, defaultdict
 from dataclasses import dataclass, field
-from datetime import datetime, timedelta
-from typing import List, Dict, Optional
+from datetime import datetime
+from typing import Dict, List, Optional
 
 from .collector import RawEntry, priority_to_severity
 from .patterns import match_patterns, Pattern
@@ -20,7 +21,8 @@ class Event:
     message: str
     source: str
     patterns: List[Pattern] = field(default_factory=list)
-    count: int = 1          # after deduplication
+    count: int = 1                              # after deduplication
+    last_timestamp: Optional[datetime] = None   # last repetition when count > 1
 
 
 # ── Analysis result ───────────────────────────────────────────────────────────
@@ -42,22 +44,29 @@ class AnalysisResult:
 
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
-def _deduplicate(events: List[Event], window_seconds: int = 60) -> List[Event]:
+# Standalone integers (PIDs, ports, counters) — but not IPv4 octets, versions or times.
+_VOLATILE_NUMBER = re.compile(r'(?<![\d.:])\d+(?![\d.:])')
+
+
+def _deduplicate(events: List[Event], window_seconds: int = 300) -> List[Event]:
     """
-    Merge identical messages that repeat within `window_seconds`.
-    Keeps the first occurrence with a count of how many times it appeared.
+    Merge identical messages from the same service while they keep repeating
+    (each repetition less than `window_seconds` after the previous one).
+    Keeps the first occurrence with a count and the time of the last repetition.
     """
     result: List[Event] = []
-    seen: Dict[str, Event] = {}
+    groups: Dict[tuple, Event] = {}
 
     for ev in events:
-        key = (ev.service, ev.message[:120])
-        if key in seen:
-            last = seen[key]
-            if (ev.timestamp - last.timestamp).total_seconds() <= window_seconds:
-                last.count += 1
+        key = (ev.service, _VOLATILE_NUMBER.sub('#', ev.message[:200]))
+        group = groups.get(key)
+        if group is not None:
+            last = group.last_timestamp or group.timestamp
+            if (ev.timestamp - last).total_seconds() <= window_seconds:
+                group.count += 1
+                group.last_timestamp = ev.timestamp
                 continue
-        seen[key] = ev
+        groups[key] = ev
         result.append(ev)
 
     return result
@@ -73,29 +82,39 @@ def _peak_minute(events: List[Event]) -> Optional[datetime]:
 
 def _detect_cascades(events: List[Event], window_seconds: int = 120) -> List[str]:
     """
-    Detect cascading failures: service A fails, service B fails shortly after.
-    Returns human-readable descriptions.
+    Detect cascading failures: service A has a critical event, service B starts
+    failing shortly after. One line per (A, B) pair, using A's first critical event.
     """
     cascades = []
+    seen_pairs = set()
     criticals = [e for e in events if e.severity == 'CRITICAL']
     errors = [e for e in events if e.severity == 'ERROR']
 
     for trigger in criticals:
         for follow in errors:
-            if follow.service == trigger.service:
+            pair = (trigger.service, follow.service)
+            if follow.service == trigger.service or pair in seen_pairs:
                 continue
             delta = (follow.timestamp - trigger.timestamp).total_seconds()
             if 0 < delta <= window_seconds:
+                seen_pairs.add(pair)
                 cascades.append(
-                    f"**{follow.service}** errors began "
-                    f"**{int(delta)}s** after first **{trigger.service}** critical event "
+                    f"**Cascading failure**: `{follow.service}` errors began "
+                    f"**{int(delta)}s** after the first `{trigger.service}` critical event "
                     f"({trigger.timestamp.strftime('%H:%M:%S')})"
                 )
-                break  # one cascade per trigger service pair
-
     return cascades
 
 
+_SEV_RANK = {'CRITICAL': 0, 'ERROR': 1, 'WARNING': 2, 'INFO': 3, 'DEBUG': 4}
+
+
+def service_matches(service: str, wanted: List[str]) -> bool:
+    """'postgresql' matches 'postgresql', 'postgresql@14-main' and 'postgresql.service'."""
+    s = service.lower()
+    return any(s == w or s.startswith((w + '@', w + '.', w + '-')) for w in wanted)
+
+
 # ── Main analyser ─────────────────────────────────────────────────────────────
 
 def analyze(raw: List[RawEntry], services_filter: List[str] = None) -> AnalysisResult:
@@ -103,15 +122,15 @@ def analyze(raw: List[RawEntry], services_filter: List[str] = None) -> AnalysisR
 
     # 1. Normalise RawEntry → Event and run pattern matching
     events: List[Event] = []
+    wanted = [s.lower() for s in services_filter or []]
     for r in raw:
-        if services_filter and r.service.lower() not in [s.lower() for s in services_filter]:
+        if wanted and not service_matches(r.service, wanted):
             continue
         severity = priority_to_severity(r.priority)
         matched = match_patterns(r.message)
-        # Upgrade severity based on pattern if stricter
-        sev_rank = {'CRITICAL': 0, 'ERROR': 1, 'WARNING': 2, 'INFO': 3, 'DEBUG': 4}
+        # Upgrade severity when a known pattern is more serious than the log priority
         for p in matched:
-            if sev_rank.get(p.severity, 4) < sev_rank.get(severity, 4):
+            if _SEV_RANK.get(p.severity, 4) < _SEV_RANK.get(severity, 4):
                 severity = p.severity
         events.append(Event(
             timestamp=r.timestamp,
@@ -156,10 +175,10 @@ def analyze(raw: List[RawEntry], services_filter: List[str] = None) -> AnalysisR
     factors: List[str] = []
 
     # Restart loops
-    restart_counts = Counter(
-        e.service for e in timeline
-        if any(p.name == 'service_restart' for p in e.patterns)
-    )
+    restart_counts: Counter = Counter()
+    for e in timeline:
+        if any(p.name == 'service_restart' for p in e.patterns):
+            restart_counts[e.service] += e.count
     for svc, cnt in restart_counts.most_common():
         factors.append(
             f"**Service instability**: `{svc}` triggered restart-loop detection **{cnt} time(s)**"