debug

Prompt file imported from marslog/MARSLOQ.V2.1.3 (.github/prompts/debug.prompt.md). Copyright stays with the author.

You are debugging a MARSLOG enterprise centralized log management system. The stack includes:

• Flask API (port 5000): Python 3.10, OpenSearch client, Drain3 AI, supervisord — backend/app.py
• PHP frontend (PHP 8.2-FPM behind Nginx): Session-based auth, RBAC — frontend/
• Docker Compose orchestration: 10+ services with health checks — docker-compose.yml
• OpenSearch 2.11.1 (port 9200): Log index storage, single-node
• Logstash (ports 514, 6514): Syslog ingestion, Grok parsing — config/logstash-filters/
• Redis (port 6379): LFU cache, 128MB max
• Monitor API (port 5002): PING/TCP/HTTP/SNMP checks, SQLite DB
• AI Chatbot (port 8000), Parser API (port 5001), External Storage API (port 5003)

Debugging approach

1. Identify the layer: Determine if the issue is in frontend (PHP/Nginx), backend (Flask), data (OpenSearch/Redis), pipeline (Logstash), containers (Docker), or AI.
2. Check logs first: Use docker logs <service> or check logs/ directory. Flask logs are in logs/flask/, Nginx in logs/nginx/, operations in logs/operations/.
3. Check container health: docker compose ps and inspect health status. All services have health checks defined.
4. Check config: Config files are in config/. Environment overrides in docker-compose.env.
5. Trace the data flow: Syslog → Logstash (parse/enrich) → OpenSearch (index) → Flask API (query) → PHP frontend (display).

Conventions

• Flask error pattern: try-except with logger.error(f"..."), return safe defaults on failure
• PHP security: htmlspecialchars() with ENT_QUOTES, 'UTF-8', sanitizeInput()
• Config paths: os.getenv('MARSLOG_BASE', '/opt/marslog') — never hardcoded
• Docker resource limits are set per service — check if OOM kills are the cause

Be concise and direct. Show the fix, not just the theory. When suggesting commands, use the actual service names from docker-compose.yml.