Tech, ExplainedCloud platforms and developer tools
Product

AI SRE

The AI reads the alert before you wake.

BEFORE ITAFTER ITAI SREHEAL SoftwareDrDroidCiroosCOVERSReads alertsFinds changesWrites diagnosisSuggests fixObservability platformsendseach alertInfrastructure monitoringreportsserver stateNetwork AIOpssends groupedalarmsreads recentchangesCode repository↗ DEVOPSCONCEPTS IT USESObservabilityAnomaly detectionAlert triageAI coding agentsBEFORE ITAFTER ITAI SREHEAL SoftwareDrDroidCiroosCOVERSReads alertsFinds changesWritesdiagnosisSuggests fixObservabilityplatformsendseach alertInfrastructuremonitoringreportsserver stateNetwork AIOpssends groupedalarmsreads recentchangesCode repository↗ DEVOPSCONCEPTS IT USESObservabilityAnomaly detectionAlert triageAI coding agentsBEFORE ITObservability platform↓ sends each alertInfrastructure monitoring↓ reports server stateNetwork AIOps↓ sends grouped alarmsAI SREHEAL SoftwareDrDroidCiroosReads alertsFinds changesWrites diagnosisSuggests fixAFTER IT↓ reads recent changesCode repository↗ DEVOPSCONCEPTS IT USESObservabilityAnomaly detectionAlert triageAI coding agents
The AI SRE receives alerts from the observability platform, server state from infrastructure monitoring and grouped alarms from network AIOps, and reads recent changes in the code repository.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

An AI SRE is an AI agent that investigates an alert from a live app before a human engineer does. It reads the alert, the logs, the traces and the recent changes to the code. Then it either fixes the problem or hands the on-call engineer a diagnosis, with the evidence. SRE stands for site reliability engineer, an engineer whose job is to keep a live service running. The product is also called an AI on-call agent, or AI for root cause analysis.

Why does this product exist? Software teams take turns to be on call. The engineer on call carries a phone that rings when an alert fires, even at 3 a.m. An alert fires when something breaks in production, the live system that customers use. The industry calls such a breakdown an incident. Most of the first half-hour of an incident goes on the same routine. The engineer opens the graphs, reads the logs, checks what changed recently, and rules out the usual causes. An AI agent can do this routine in a few minutes, at any hour.

How does it work? The agent is connected to the tools that the team already has. It can ask the observability platform for metrics, logs and traces. It can read infrastructure monitoring for the state of the servers. It can read the code repository for the changes that were deployed recently. To deploy a change means to put a new version of the software into production. The agent uses a language model, the kind of AI behind chatbots, to decide which question to ask next, as an engineer would. The approach is close to that of an AI coding agent. The difference is that this agent investigates a live system, instead of writing new features.

Take, for example, a startup in Bengaluru that sells invoicing software to small businesses. At 2:47 a.m., an alert fires: 6% of invoice downloads are failing. The AI SRE starts at once. In the first minute, it finds that the failures began at 2:33. In the second minute, it finds a change deployed at 2:31, which updated the library that creates the PDF files. In the third minute, it reads the logs. Every failed download has the same error from that library. It writes a short report. The likely cause is the change at 2:31. The evidence is the error lines and the timing. The suggested fix is to roll back the change, which means restoring the previous version. The engineer on call reads the report on her phone, agrees, and approves the rollback. Downloads work again by 3:02 a.m.

Most teams allow the agent to suggest a fix but not to make it. A person approves every fix, an arrangement called human in the loop. Some teams let the agent act alone, but only on a short list of safe actions, such as restarting a service that has stopped responding.

The AI SRE also receives grouped alarms from network AIOps, so that it can see problems in the network too. Its first job with every alert is alert triage: deciding whether the alert is real, and how urgent it is.

Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.