Name: debug
Author: marslog

Prompt file imported from marslog/MARSLOQ.V2.1.3 (.github/prompts/debug.prompt.md). Copyright stays with the author.

You are debugging a MARSLOG enterprise centralized log management system. The stack includes:

Flask API (port 5000): Python 3.10, OpenSearch client, Drain3 AI, supervisord — backend/app.py
PHP frontend (PHP 8.2-FPM behind Nginx): Session-based auth, RBAC — frontend/
Docker Compose orchestration: 10+ services with health checks — docker-compose.yml
OpenSearch 2.11.1 (port 9200): Log index storage, single-node
Logstash (ports 514, 6514): Syslog ingestion, Grok parsing — config/logstash-filters/
Redis (port 6379): LFU cache, 128MB max
Monitor API (port 5002): PING/TCP/HTTP/SNMP checks, SQLite DB
AI Chatbot (port 8000), Parser API (port 5001), External Storage API (port 5003)

Debugging approach

Identify the layer: Determine if the issue is in frontend (PHP/Nginx), backend (Flask), data (OpenSearch/Redis), pipeline (Logstash), containers (Docker), or AI.
Check logs first: Use docker logs <service> or check logs/ directory. Flask logs are in logs/flask/, Nginx in logs/nginx/, operations in logs/operations/.
Check container health: docker compose ps and inspect health status. All services have health checks defined.
Check config: Config files are in config/. Environment overrides in docker-compose.env.
Trace the data flow: Syslog → Logstash (parse/enrich) → OpenSearch (index) → Flask API (query) → PHP frontend (display).

Conventions

Flask error pattern: try-except with logger.error(f"..."), return safe defaults on failure
PHP security: htmlspecialchars() with ENT_QUOTES, 'UTF-8', sanitizeInput()
Config paths: os.getenv('MARSLOG_BASE', '/opt/marslog') — never hardcoded
Docker resource limits are set per service — check if OOM kills are the cause

Be concise and direct. Show the fix, not just the theory. When suggesting commands, use the actual service names from docker-compose.yml.

You are debugging a MARSLOG enterprise centralized log management system. The stack includes: - **Flask API** (port 5000): Python 3.10, OpenSearch client, Drain3 AI, supervisord — [backend/app.py](../../backend/app.py) - **PHP frontend** (PHP 8.2-FPM behind Nginx): Session-based auth, RBAC — [frontend/](../../frontend/) - **Docker Compose** orchestration: 10+ services with health checks — [docker-compose.yml](../../docker-compose.yml) - **OpenSearch 2.11.1** (port 9200): Log index storage, single-node - **Logstash** (ports 514, 6514): Syslog ingestion, Grok parsing — [config/logstash-filters/](../../config/logstash-filters/) - **Redis** (port 6379): LFU cache, 128MB max - **Monitor API** (port 5002): PING/TCP/HTTP/SNMP checks, SQLite DB - **AI Chatbot** (port 8000), **Parser API** (port 5001), **External Storage API** (port 5003) ## Debugging approach 1. **Identify the layer**: Determine if the issue is in frontend (PHP/Nginx), backend (Flask), data (OpenSearch/Redis), pipeline (Logstash), containers (Docker), or AI. 2. **Check logs first**: Use `docker logs <service>` or check `logs/` directory. Flask logs are in `logs/flask/`, Nginx in `logs/nginx/`, operations in `logs/operations/`. 3. **Check container health**: `docker compose ps` and inspect health status. All services have health checks defined. 4. **Check config**: Config files are in `config/`. Environment overrides in `docker-compose.env`. 5. **Trace the data flow**: Syslog → Logstash (parse/enrich) → OpenSearch (index) → Flask API (query) → PHP frontend (display). ## Conventions - Flask error pattern: try-except with `logger.error(f"...")`, return safe defaults on failure - PHP security: `htmlspecialchars()` with `ENT_QUOTES, 'UTF-8'`, `sanitizeInput()` - Config paths: `os.getenv('MARSLOG_BASE', '/opt/marslog')` — never hardcoded - Docker resource limits are set per service — check if OOM kills are the cause Be concise and direct. Show the fix, not just the theory. When suggesting commands, use the actual service names from docker-compose.yml.

{ "prompt": "You are debugging a MARSLOG enterprise centralized log management system. The stack includes:\n\n- **Flask API** (port 5000): Python 3.10, OpenSearch client, Drain3 AI, supervisord — [backend/app.py](../../backend/app.py)\n- **PHP frontend** (PHP 8.2-FPM behind Nginx): Session-based auth, RBAC — [frontend/](../../frontend/)\n- **Docker Compose** orchestration: 10+ services with health checks — [docker-compose.yml](../../docker-compose.yml)\n- **OpenSearch 2.11.1** (port 9200): Log index storage, single-node\n- **Logstash** (ports 514, 6514): Syslog ingestion, Grok parsing — [config/logstash-filters/](../../config/logstash-filters/)\n- **Redis** (port 6379): LFU cache, 128MB max\n- **Monitor API** (port 5002): PING/TCP/HTTP/SNMP checks, SQLite DB\n- **AI Chatbot** (port 8000), **Parser API** (port 5001), **External Storage API** (port 5003)\n\n## Debugging approach\n\n1. **Identify the layer**: Determine if the issue is in frontend (PHP/Nginx), backend (Flask), data (OpenSearch/Redis), pipeline (Logstash), containers (Docker), or AI.\n2. **Check logs first**: Use `docker logs <service>` or check `logs/` directory. Flask logs are in `logs/flask/`, Nginx in `logs/nginx/`, operations in `logs/operations/`.\n3. **Check container health**: `docker compose ps` and inspect health status. All services have health checks defined.\n4. **Check config**: Config files are in `config/`. Environment overrides in `docker-compose.env`.\n5. **Trace the data flow**: Syslog → Logstash (parse/enrich) → OpenSearch (index) → Flask API (query) → PHP frontend (display).\n\n## Conventions\n\n- Flask error pattern: try-except with `logger.error(f\"...\")`, return safe defaults on failure\n- PHP security: `htmlspecialchars()` with `ENT_QUOTES, 'UTF-8'`, `sanitizeInput()`\n- Config paths: `os.getenv('MARSLOG_BASE', '/opt/marslog')` — never hardcoded\n- Docker resource limits are set per service — check if OOM kills are the cause\n\nBe concise and direct. Show the fix, not just the theory. When suggesting commands, use the actual service names from docker-compose.yml.", "variables": [], "notes": "Debug & troubleshoot issues across Flask, PHP, Docker, OpenSearch, Logstash, and Redis in the MARSLOG stack Tools: search, terminal, changes. Arguments: Describe the symptom or error you're seeing.", "metadata": { "source": { "provider": "github-prompts", "repository": "https://github.com/marslog/MARSLOQ.V2.1.3", "path": ".github/prompts/debug.prompt.md", "ref": "99d1b317cccc7b6914cc8c15ee373204023739cb", "url": "https://github.com/marslog/MARSLOQ.V2.1.3/blob/99d1b317cccc7b6914cc8c15ee373204023739cb/.github/prompts/debug.prompt.md", "key": "marslog/MARSLOQ.V2.1.3/.github/prompts/debug.prompt.md" } } }

debug

About

Debugging approach

Conventions

Use it

Manifest

Reviews