Expanso and Jev Demo Shows Why INFO Alone Can Miss Actionable Logs

Summary

An Expanso and Jev demonstration examines whether log severity alone is enough to decide which records deserve attention. A severity-only policy would archive an INFO message saying that a configuration reload was requested by an unknown actor, but Jev evaluated the assembled context as warning-level and actionable, sending it to NOTIFY. In the recorded run, the model produced a severity confidence score of 0.74 and an actionability score of 0.72; the authors stress that these are inspectable run-specific scores, not calibrated probabilities or evidence that an attack occurred. The pipeline preserves the original record, structures it, computes a fingerprint, and tracks occurrences within a ten-minute window before asking Jev about actionability, severity, ownership, and recurrence-related concern. Explicit pipeline gates then choose among PAGE, NOTIFY, REVIEW, and ARCHIVE, keeping the model’s judgments separate from the final routing policy. Known benign records can bypass inference through an exact match on level, service, and raw message, while novel INFO records and WARN or ERROR records still reach Jev; bypassed records remain archived. The demo also injects a simulated 503 from Jev to exercise holding and retrying unanswered records, with two-to-four-second jittered waits and a configured retry limit after which records move to REVIEW. The example relies on an in-memory counter and local files, so it does not establish durable delivery, exactly-once processing, crash-safe zero loss, or successful delivery to external paging systems. The authors recommend testing narrow rules and routing thresholds against labeled incidents and routine traffic, reviewing both missed events and unnecessary escalations before applying the pattern to on-call workflows.