Turn a Slack Report into a Root Cause with an AI SRE Agent
A coworker says checkout is broken and nothing else. That is the whole prompt. AURA reads the live logs and comes back with the payment service.
- Learn more about AURA → https://www.mezmo.com/aura
- Get started today → https://github.com/mezmo/aura
- Get deployment help→ https://www.mezmo.com/contact
Normally a message like this is the start of guessing at a service and opening dashboards until something looks wrong. Here it is the entire input: no service named, no error string, no time range.
AURA hands the question to its log analysis worker, which converts the relative time into a bounded UTC window and queries live Mezmo data from the OpenTelemetry Astronomy Shop demo. What comes back is the front-end proxy returning HTTP 500 on checkout while browse and cart return 200, traced downstream to invalid payment tokens on gold loyalty events.
It also comes back with a limit. The logs carry no shared trace or request identifier, so the analysis calls the correlation temporal and count-based rather than one-to-one trace proof, and recommends adding that correlation as a next step. Nothing in production changed.
AURA is built for on-call SREs who need a root cause from a plain-language symptom report without knowing which service to open first.
Chapters:
0:00 A coworker reports checkout failing during payment
0:10 Handing the Slack report to AURA in plain language
0:29 AURA, the Mezmo MCP server, and the OpenTelemetry demo data
0:55 The log analysis worker builds a bounded timeline
1:17 Confirming the symptom: HTTP 500 on checkout only
1:30 Tracing the failure to the payment service
1:47 Separating evidence from inference
2:08 Recommended next steps, with nothing changed in production
2:28 Pasting the analysis back into Slack
#AILogAnalysis #Observability #SRE
Transcript
A coworker reports checkout failing during payment
0:00 Hi everyone, I'm Henry. A coworker has reported that customers can browse and use their carts, but checkout is failing during payment.
Handing the Slack report to AURA in plain language
0:10 This is a normal operational handoff in Slack. There is no Slack integration in this demo. I'm going to copy the report and give it directly to AURA.
AURA, the Mezmo MCP server, and the OpenTelemetry demo data
0:29 AURA is running locally and is connected to Mezmo through the Mezmo MCP server. The OpenTelemetry Astronomy Shop is already sending logs, traces, and metrics into Mezmo.
I have only described the user-visible symptom. I have not told AURA which service is broken or what error to look for.
The log analysis worker builds a bounded timeline
0:55 AURA delegates this to its log analysis worker. The worker converts the relative time into a bounded UTC window, queries the live Mezmo data, groups recurring errors, and builds a timeline across the affected services.
Confirming the symptom: HTTP 500 on checkout only
1:17 AURA has confirmed the symptom from the data. The frontend-proxy is returning HTTP 500 for the checkout endpoint, while browse and cart requests continue to return HTTP 200.
Tracing the failure to the payment service
1:30 It then traces the failure downstream to the payment service. The dominant warning is "payment request failed, invalid token," and the affected events carry the gold loyalty level. The checkout 500 count and payment warning count line up in the same window.
Separating evidence from inference
1:47 AURA also separates evidence from inference. It has high confidence that payment token rejection is causing the checkout failures, but it calls out that the logs do not contain a shared trace or request identifier, so the correlation is temporal and count-based rather than a one-to-one trace proof.
Recommended next steps, with nothing changed in production
2:08 Finally, it recommends concrete next steps. Inspect recent payment token changes, verify signing and validation configuration, improve error handling, and add direct trace or request correlation to the payment logs. It does not claim to have changed production.
Pasting the analysis back into Slack
2:28 Now we can take the output, paste it back in Slack, and that is the workflow. A coworker reports a symptom, I hand it to AURA in plain language, and AURA uses Mezmo's live telemetry to return an evidence-backed root cause analysis and next steps.
More videos
