Analyze macOS unified logs and session forensics to diagnose system failures.
npx skills add https://github.com/bjornjee/agent-dashboard --skill rca-bjornjee
Please help me install this Agent Skill. Skill: rca Source: https://github.com/bjornjee/agent-dashboard/tree/main/adapters/claude-code/skills/rca Command: npx skills add https://github.com/bjornjee/agent-dashboard --skill rca-bjornjee
This Skill helps you perform root cause analysis for process crashes, server deaths, and unexplained system failures by collecting and validating evidence first, then reasoning from that evidence.
Run the RCA skill with your incident description (for example, describe which process died, when it started failing, and what you observed), and the skill will guide you through evidence gathering before concluding a root cause.
High-intent search queries and answers about installing and using this skill.
Root cause analysis for a process crash involves collecting evidence from macOS unified logs, session forensics, and crash reports within a specific time window before reasoning about the cause.
To trace the last command before a server crash, you can parse session JSONL logs to extract Bash tool calls, flag dangerous commands, and identify the final command executed in the tmux session.
Yes, macOS unified logs provide the necessary forensics to investigate AMFI code-signing failures, jetsam memory pressure events, termination signals, and kernel events to determine why a process died.
The best way to structure an incident timeline for unexplained system failures is to use phase-gated evidence collection, creating a timestamped event chain that includes ruled-out alternatives and contributing factors.
Diagnosing unexpected Claude Code agent execution terminations requires extracting executed Bash commands from session logs and tracing code path cascades to identify the crash trigger.
Evidence-first incident investigation uses crash reports alongside process events and session forensics to validate the root cause, but it also produces ruled-out alternatives if crash reports are insufficient.
rjonhaasTriage macOS artifact collections with mac_apt and Unified Logs.
KentoShimizuCompile incident timelines, root-cause chains, and owned prevention actions.
guille-galloBlock dangerous git commands before execution using Claude Code PreToolUse hooks.
openeuler-mirrorCorrelate kernel logs, process memory snapshots, and cgroup metrics to diagnose Linux OOM events.
