Troubleshooting investigations

When an investigation does not go the way you expect, the cause is usually the data the agent has access to, not the question you asked. Find your symptom below and work the checks in order.

The agent can't find logs I know exist

Work these in order:

1. Confirm the source is flowing. Go to Settings > Log streams and check that the source you expect is connected and showing recent intake activity. A source that silently stopped sending is the most common cause.
2. Check the time range. Ask again with an explicit window ("in the last 6 hours"). If the logs are older than your plan's retention window, they are no longer searchable — see Confidence, uncertainty & limits.
3. Allow for ingestion latency. A log emitted seconds ago takes a short time to become searchable. If you are chasing something that happened moments ago, wait a minute and ask again.
4. Check the filters. If you asked the agent to filter by a service or severity, confirm those values match what your source actually sends — a mismatch in the service name or severity label returns nothing even though the logs are there. Ask the agent to search without the filter to see what is present.
5. Confirm the right project. Logs land in the project whose intake URL received them. If you are in the wrong project, the logs will not be there — switch projects and try again.

Answers reference the wrong service or time range

1. State the window explicitly. "since 14:00 UTC today" removes ambiguity that "recently" leaves open.
2. Name the service the way your logs label it. If your logs call it orders-api, use that exact name rather than a friendly name.
3. Give the agent context. If your project has several services with similar names, say which one you mean. Writing that mapping to project memory fixes it for future investigations.
4. Read the tool calls. Expand the agent's queries to see exactly what it searched; if the service or window is wrong there, correct it in your next message and the agent adjusts.

The thread stalls or times out

1. Narrow the question. A very broad query over a long window is slow. Ask about a specific service and a shorter window, then widen once you have a lead.
2. Continue in the same thread. Send a follow-up rather than starting over — the agent keeps the context it has already built.
3. Fork if it went down the wrong path. Fork the thread from an earlier message and take a cleaner angle instead of fighting a long, tangled conversation.
4. Check sandbox-dependent steps. If the investigation relies on a connected CLI, confirm that CLI connection still passes its test under Settings > Sandbox CLIs — an expired credential can stall a step. See Set up the sandbox.

Getting help

If you have worked the checks above and the investigation still fails, gather the thread link and what you expected versus what happened, and reach out through your usual Sazabi support channel. For ingestion problems specifically — logs not arriving at all — see Troubleshooting ingestion.

Further reading