Platform · Diagnose
LIVEDiagnose: autonomous investigation across the device-software stack.
One investigation engine, pointed at a question, a single capture, or many at once. Quick returns a cited answer in seconds. Deep Research investigates one capture end to end. Delta correlates across many. Same parsers, same correlation, same citation discipline underneath.
The modes
One engine. Three scopes.
You don't switch tools between them. You widen the question: point Delta at a single thing, or at many.
Quick
One question, one cited answer, in seconds. The fastest way in.
Deep Research
Point it at one artifact and it investigates end to end: multi-step reasoning, follow-ups, structured findings.
Delta
Give it several artifacts and it correlates across them: isolates regressions and traces cross-layer chains across builds, devices, and time.
One engine. Four primitives.
Quick, Deep Research, and Delta aren't three products. They're the same engine at three scopes: point it at a question, a single capture, or many at once.
Parser layer
Every signal format in device software, natively understood. Bugreports, logcat, dmesg, journalctl, CAN traces, kernel oops, U-Boot output, modem signaling. Each parsed with format-aware structure, not treated as text.
Correlation engine
Cross-subsystem causal reasoning. Aligns timestamps across kernel, HAL, framework, modem, and bus layers so a single trace tells the whole story instead of fragments per buffer.
Investigation engine
Multi-step autonomous reasoning with self-correction. Forms hypotheses, gathers evidence, cross-checks against other artifacts, and revises when the evidence pushes back.
Citation discipline
Every claim grounded in source signals. Findings cite the exact lines, sessions, and artifacts they came from. Failed hypotheses surface as failed, not hidden.
Deep Research: depth on a single signal.
Ask a question about one artifact (a bugreport, a logcat session, a dmesg dump) and the engine investigates it end to end. Multi-step reasoning, follow-up questions, structured findings with line-level citations.
Multi-Step Investigation
Deep Research plans an investigation strategy, executes multiple searches, and refines its approach based on what it discovers. If the first hypothesis doesn't hold, it pivots.
Follow-Up Questions
Drill deeper into any finding. Deep Research retains full context from previous steps, so follow-ups build on what's already been discovered.
Cross-Layer Reasoning
Traces cause-and-effect chains across logcat, dmesg, bugreport sections, and telecom traces. Connects events that span system layers and time windows.
Shareable Reports
Every investigation produces an organized report: root cause, supporting evidence from log lines, causal chain, and actionable recommendations. Share via link, no account required.
Most investigations widen as they go. A Quick answer raises a question, Deep Research runs it down on one capture, and Delta confirms whether it repeats across builds and devices.
Delta: breadth across many signals.
Drop in multiple artifacts (across builds, devices, time periods, or subsystems) and the engine aligns them, isolates regressions, and traces cross-layer causal chains. The capability horizontal AI tools structurally cannot replicate.
Cross-Layer Correlation
Upload multiple log files (logcat, dmesg, bugreport sections) and Delta finds related events across system layers. See how a low-level kernel event connects to a framework error and ultimately an app crash.
Regression Detection
Compare logs from two software versions on the same device. Delta identifies what changed (new errors, timing shifts, missing events) so you know exactly what the update broke.
Device-to-Device
Same software, different hardware. Upload logs from Device A and Device B to find device-specific behaviors, hardware quirks, or configuration differences.
Before/After Analysis
Compare logs from before and after a system update, configuration change, or firmware update to isolate the exact impact of the change.
Multi-Source Investigation
Combine bugreport + kernel dmesg + logcat to build a complete picture. The more context you provide, the better the AI can trace cause-effect chains.
Field Test Comparison
Compare field test logs from different locations, times, or conditions. Identify environment-specific issues, time-of-day patterns, or configuration-specific behaviors.
GC heap budget regression in build TQ3A.230901.
Cites: AOSP Issue #312445 · Affects 3 of 5 Pixel 8 sessions on this build
Pixel 8 OTA regression · 6 days apart, same device
Delta Correlation Engine
Multi-file cross-layer analysis
Upload multiple log files for comparison
The picture comes with the answer.
Every analysis returns a visual layer as well as prose, built automatically from your file, shaped to the artifact, and tied back to the exact lines behind every figure. No board to wire up, no queries to write.
Quiet in this capture · Fatal exceptions · App freeze / unfreeze · Low-memory kills · Network up / down · switch · Weak signal (RSRP ≤ -110)
Bugreport · event timeline across reliability, process, security, and foreground lanes
Real charts from actual analyses of five log types, plus one from a synthetic CAN trace, marked as such. Identities are substituted; every shape and number is as measured.
Every signal format in device software.
Binary formats are decoded natively. Text streams are profiled without a per-format parser. Same engine across all of them.
Mobile
- Bugreport (.zip, 30+ sections)
- Logcat (threadtime / brief / time)
- ANR traces & tombstones
- Dumpsys (batterystats, meminfo, ...)
- Event log binary stream
Modem & Connectivity
- Qualcomm baseband captures, uploaded as captured
- RIL & telephony framework logs
- Decoded vendor telecom text exports
- Bluetooth HCI snoop logs
- Packet captures (.pcap / .pcapng)
Automotive
- CAN bus (candump, Vector .asc and .blf, DTS .trc)
- DLT / AUTOSAR traces
- CAN signal databases (.dbc)
- VHAL property events
- AAOS / Android Automotive logs
Embedded Linux & Silicon
- dmesg (ARM · x86 · MIPS · RISC-V)
- journalctl (systemd journal)
- Linux kernel core dumps (vmcore / kdump)
- Vendor crash dumps (.7z region sets)
- U-Boot & bootloader logs
- Buildroot · OpenWrt firmware logs
- Kernel panics · driver traces
Traces, recordings & archives
- System traces (perfetto)
- Robot recordings (bag / MCAP / database)
- Multi-file archives read as one situation
- SQLite snapshots
- Access point & router configuration
- CTS / VTS / GTS / STS result XML
Runtime-to-source attribution · how Diagnose reads the code behind a log line.
A log line on its own says what happened, not why the code chose to print it. Runtime-to-source attribution resolves the line back to the place in the platform source that emitted it, so Diagnose reasons about what that code actually does instead of what the public internet thinks code that looks like it does. We hold the platform trees, so there is nothing for you to index and no source of yours to hand over.
Multi-language
C/C++, Java/Kotlin, Go, Rust, kernel printk, and more
Cross-boundary
follows IPC and cross-repo references in complex codebases like AOSP
Proven at scale
hundreds of thousands of log sites across full AOSP and Linux
Nothing to hand over
cites the platform trees we hold, so your own code stays where it is
In research preview.
Forensic, not monitoring.
Diagnose investigates artifacts after the fact (bugreports, log captures, traces) rather than streaming live telemetry or paging on threshold breaches. Use it alongside an APM, not instead of one.
Frequently asked.
Questions that come up most often in technical conversations about Diagnose.
Quick when you want a fast, cited answer to a single question. Deep Research when you have one capture and want it investigated end to end: why this device drained battery, what caused this ANR, what happened during this boot. Delta when you have several captures and want to know what changed: between two builds, across devices, before and after an OTA. Most real investigations move between all three.
Native parsers for structured binaries (Android bugreports, CAN bus traces, modem QXDM, journal binary streams). Format-agnostic profiling for any plain-text log (dmesg, journalctl, U-Boot output, syslog, custom application logs) where the system generates domain context dynamically rather than relying on a per-format parser.
Delta is built for multi-file comparison across builds, devices, time periods, and subsystems. Practical batches range from 2 (before/after) to dozens (regression hunts across many captures). Total payload size matters more than file count.
Diagnose covers everything from the kernel up, including the runtime signatures of build issues (boot failures on a built image, kernel oops from a misconfigured driver, dmesg from a broken device tree). It does not yet investigate the bitbake build process itself or do static recipe-level analysis. That capability lands with Remediate, now in research preview.
SaaS deployments hold uploads for the configured retention window (90 days by default) inside logcat.ai infrastructure. On-prem deployments keep all data inside the customer environment. See the security architecture page. Customer data is never used to train AI models.
Diagnose ships today. Enterprise pricing is scoped per deployment (seats, on-prem vs. SaaS, support level). Request a demo and we'll scope the right shape for your team.
Bring us a real log.
Upload a real bugreport, logcat, dmesg, or trace. We'll show you Deep Research or Delta on it. Your actual data, your actual stack. From there, we'll scope a pilot for your team.