Wake up to the investigation, not just the alert.
The page still comes at 03:12. But the first look is already done: what broke, since when, the likely cause tied to evidence lines, and a next step, written onto the service's timeline by an agent that read the whole story.
03:12HighCheckoutLatency firing
service=api-server · severity=page
3 minutes later, on the same timeline
03:15finding · incident-first-look
- broke
- checkout p99 640ms → 1.18s, since 03:02
- cause
- uncapped retries from the 01:50 deploy (PR #482)
- evidence
- 4 lines cited: metrics, logs, the deploy event
- next
- cap retries at 3, or roll back
delivered to #incidents · written before you opened your laptop
What an AI SRE is made of. configuration, not code.
Tell Tares where your metrics, logs and alerts live, and it builds the rest for you. Every piece below is visible in the console and yours to edit:
- sources
- Metrics from Prometheus, the request logs, and the alerts Prometheus fires. All carry the same service label; that shared key is the whole trick, and any source you run joins the same way.
- the timeline
- service_timeline joins them on that key: metrics, logs and alerts for one service, on one clock. Add a deploy webhook and root causes start arriving with their cause attached.
- the trigger
- Fires when an alert event lands on the view. Prometheus keeps owning the thresholds; Tares reacts to what fired. A cooldown keeps one incident from waking the agent forty times.
- the agent
- Its whole definition is a prompt: take the first look, tie the failure to evidence lines, suggest a next action. It runs inside Tares and writes its finding back onto the service's timeline.
Pointing it at your real systems works the same way: your Prometheus queries, your logs, your alerts, and a webhook for deploys, which is where most root causes hide. Connect as many sources as you run.
What a finding contains. evidence lines included.
What broke, since when, the cause tied to specific evidence lines, and a suggested next action. It lands on the service's timeline next to the evidence, and in Slack if you want it there. The next investigation, human or agent, starts from it.
Run the demo, inject a fault. watch the finding land.
The demo stack is a small production system: an api-server with Prometheus scraping it and a traffic generator. One file wires the whole thing. Inject a fault, watch it work.
The guide walks every step; bringing your own agent is cookbook 01.