# Logs Are All You Need: Rethinking Observability with AI Agents

## Executive summary

Sherwood Callaway introduces Sazabi, an AI-native observability platform designed to disrupt traditional tools like Datadog by focusing on logs as the primary source of truth. The core philosophy is that in the age of coding agents, engineers should interact with production data via natural language chat rather than complex dashboards. Key technical innovations include using Git for persistent agent memory across multiple threads and implementing a read-only sandbox environment to safely execute investigative tasks.

## Key takeaways

- Logs are Sufficient: Rethinking Observability: The traditional 'three pillars' (metrics, logs, traces) are considered overkill for modern agentic workflows. By focusing solely on logs, instrumentation becomes significantly simpler, requiring only basic logging statements, as the platform can reconstruct metrics and traces from log data.
- AI Agents Generate Alerts, They Don't Evaluate Them: Instead of using AI to triage noisy alerts (alert fatigue), Sazabi autonomously generates actionable alerts directly from logs and codebase analysis. The agent determines what is meaningful to the user at runtime.
- Agent Memory via Git for Shared State: Sazabi maintains persistent, shared memory across multiple parallel sub-agents and threads by committing findings (e.g., issue lists, facts) to a dedicated Git branch within the sandbox environment. This allows agents to benefit from collective findings.
- Sandbox Isolation and Read-Only Access: The platform operates in a read-only system with no public internet access, ensuring security. All actions are routed through an isolated sandbox environment (e.g., using `bash` tools) to prevent data exfiltration or unauthorized changes.

## Technical details

- Observability Paradigm Shift: Sazabi advocates for a chat-based UX for observability, allowing users to ask natural language questions of the data rather than navigating traditional dashboards (dashboards, flame graphs, service maps).
- Agent Sandboxing & Tooling: The agent operates within a sandbox that provides access to core CLI utilities (like `ls`, `cat`) and specialized tools, such as a read-only SQL interface for the log database. All actions are contained and proxied.
- Multi-Agent Parallelization: The system supports spawning multiple sub-agents or background agents in parallel to investigate issues. These agents operate within separate sandboxes but share findings and memory via the Git file system, allowing collective problem solving.
- Context Management (MCP vs. CLI): The speaker discusses context bloat issues related to tools like MCP servers versus using a sandbox/CLI paradigm. He notes that the latter can manage tool exposure by having tools 'baked into' the environment weights, which is less prone to context rot.

## Practical implications

- Build teams should re-evaluate their observability stack, considering a log-centric approach to simplify instrumentation and reduce overhead.
- Implementing agentic workflows requires robust state management; using Git branches as the source of truth for shared memory is presented as an effective pattern for multi-agent coordination.
- Security design must prioritize read-only access and strict sandboxing (e.g., whitelisting IPs/domains) to mitigate risks associated with LLM agents accessing sensitive production data.

## Topics

Observability, AI Agents, MLOps, Software Development Lifecycle, DevSecOps, Sazabi, Cursor Cloud Agent / Cloud Code

Source: https://www.youtube.com/watch?v=RSs0PDsULJM