LogTailer Agent

The LogTailer is the entry point of the pipeline. It continuously monitors Cloudflare Workers for errors.

Responsibilities

• Poll Workers Observability API every 30 seconds
• Classify errors by HTTP status code
• Compute SHA-256 fingerprints with normalization
• Deduplicate errors using agent-local SQLite
• Create incidents in D1 and publish to the errors-detected queue

How It Works

Polling Loop

1. Load all enabled service configs from D1
2. For each service, query Workers Observability with a 60-second lookback window
3. Use a 15-second overlap to handle eventual consistency
4. Process each event through the fingerprinting pipeline

Fingerprinting

Each error is fingerprinted using:

sha256(serviceName | normalizedMessage | triggerRoute | topStackFrames)

Normalization strips dynamic values (UUIDs, timestamps, JWTs, emails, numeric IDs) so that the same root cause always produces the same fingerprint.

Deduplication Rules

Condition	Action
New fingerprint	Create D1 incident + publish to queue
Known, resolved >24h ago	Reopen incident + re-queue
Known, active	Increment occurrence count
Known, wontfix	Increment count only

Agent-Local SQLite

The LogTailer creates two tables in its embedded SQLite:

• error_fingerprints — fingerprint → incident mapping with status and timestamps
• poll_cursors — per-service cursor tracking the last processed timestamp

This allows sub-millisecond dedup lookups without hitting D1.

HTTP Endpoints

Method	Path	Description
GET	/status	Current polling state and stats
POST	/poll	Trigger an immediate poll
POST	/start	Start the polling loop
POST	/stop	Stop the polling loop

Source

src/agents/log-tailer.ts