How does an AI SRE remember what fixed error spikes last time?

Tares keeps an AI SRE’s conclusions on the service’s timeline, so the next investigation of an error spike starts from the last conclusion. Agents record findings there and write observations with the remember tool. Both sit next to the service’s logs, metrics and alerts in one correlated read.

How it works

Two things feed the same per-service timeline, and the agent reads that timeline when it investigates.

• Findings. When a trigger wakes a Tares agent, the agent reads the correlated timeline and writes a finding onto the service’s timeline. The finding says what broke, since when, the likely cause tied to evidence lines, and a next action. In the AI SRE guide, the incident-first-look agent does this for api-server when HighErrorRate fires.
• Memory. Any connected agent can call the MCP remember tool (or POST /remember) to store an observation against an entity, for example service=checkout. The memory connector stores it as an event.

Because memory is a source like any other, it is joined into reads and triggers. What an agent concluded about a service last week sits in the same timeline as the service’s logs and deploys. When the next error spike arrives, a read of that service returns the evidence and the earlier finding or observation together. The agent starts from the previous conclusion instead of from scratch.

Set it up

1. Start Tares.

tares up

2. Start the MCP endpoint in a second shell and connect your client to it. Every connected agent has the remember tool.

tares mcp

3. After you fix an error spike, ask the agent to record what worked. Name the entity so the note lands on the right timeline:

   Use tares to remember that the checkout error spike on July 1 was fixed by rolling back the pool-size change.

   The first remember call creates an agent_memory source for you. You do not need to configure anything.

4. Optional: create the memory source yourself, in the console or in YAML, only if you want a custom fallback key or several memory lanes. The key is used when a memory’s payload has no entity key, and it defaults to agent.

- name: agent_memory
  connector: memory
  config:
    key: agent

5. Check that it was stored. The observation appears in the source’s Recent events, keyed by the entity it was remembered against. It also appears in that entity’s correlated timeline.

6. At the next spike, ask your client about the same service. For example: “Use tares: what happened to checkout in the last 15 minutes?” The read returns the live evidence together with the stored conclusion.

To have findings written automatically, build the trigger and agent wiring from the AI SRE guide. A trigger wakes the agent on a fired alert, and the agent writes its finding back to the timeline.

What you get

• A record of what fixed a past spike, kept on the entity it concerns, not in a chat history.
• Investigations that start from the last conclusion. The guide’s walkthrough shows a client asking the same question before and after an incident. After the incident it reads the evidence and the finding.
• One place to look. Memory, logs, metrics, alerts and deploys share a clock and a service key, so you can see the earlier fix beside the new evidence.
• Memory available to triggers as well as reads, because it is joined like any other source.
• A clear check. Recent events on the memory source and the entity’s timeline both show what was stored.

The guide’s own summary of the loop: every investigation leaves the timeline smarter.

When something else fits

• You want diagnoses written without anyone asking. Use a trigger and a Tares agent so a finding is recorded on every firing. The AI SRE guide walks through it. Use remember when a person or an agent wants to add a specific lesson, such as the cause and the fix.
• You run your own agent service. Tares can send the timeline to your endpoint over a webhook, and your agent can write its conclusion back so the next investigation finds it.
• You only need the live evidence. If you only want metrics, logs and alerts in one read, the memory source is not required. Add it when you want conclusions to persist.

Related