Log & incident triage

Point the agent at a raw application log; it separates the distinct incidents, verifies counts with grep before writing, and produces a triage report with severity and a recommended next action per incident.

Why run it locally: Logs are full of order IDs, emails, and internal hostnames — the things you least want in a third-party prompt log. Triage is short-loop tool work (grep, read, write) with a human on the receiving end: squarely in the 4B-class sweet spot.

Model & hardware fit: 4B–9B, CPU. Logs often contain customer identifiers — a private endpoint keeps them home.

1. The server — any install works; one line on Linux:

curl -fsSL https://inference-server.searchblox.com/install | sudo bash

2. The agent — pi, a minimal open-source coding agent (four tools: read, write, edit, bash), needs Node 22+:

npm install -g --ignore-scripts @earendil-works/pi-coding-agent

3. Connect them — create ~/.pi/agent/extensions/searchai.ts:

import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

export default function (pi: ExtensionAPI) {
  pi.registerProvider("searchai", {
    baseUrl: "http://127.0.0.1:8081/v1",
    apiKey: "$SEARCHAI_API_KEY",
    api: "openai-completions",
    models: [{ id: "q35-4b", name: "SearchAI q35-4b", reasoning: false,
      input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
      contextWindow: 32768, maxTokens: 4096 }]
  });
}

export SEARCHAI_API_KEY='your-api-key'   # printed by the installer

Full setup detail (and four more worked tasks) in the pi agents article. The server works with pi stock — no compatibility flags.

pi --provider searchai --model q35-4b -p \
  "Triage app.log: identify the distinct incidents, their severity, affected \
   orders/customers, and write an incident summary to triage.md with a \
   recommended next action for each. Use grep to verify counts before writing."

Measured run (51 seconds, CPU 4B): the agent grep-verified the log, correctly separated the three real incidents — repeated payment-gateway timeouts (with affected order and customer IDs), a 502 burst on checkout, and a slow token refresh — and wrote per-incident recommended actions.

Name the output file explicitly and check it exists — small models sometimes print the report instead of writing it. For continuous triage, run the same one-shot on a timer over the last N minutes of log.

Measured: 51 s: raw log → per-incident summary with recommended actions.

Next: all the use cases · give the agent memory across sessions · 3–4× the speed with one GPU flag