In This Article
Introduction
Reef's "Nightly Brainstorm" runs at 4:00 AM: it reviews logs from the past 24 hours, identifies patterns, and suggests optimizations. The output is a Markdown report stored in memory, with an optional Slack summary for the top items. A human reviews it over morning coffee. This proactive analysis catches slow degradation — increasing error rates, memory leaks, disk growth — before they become incidents. It's one of the most valuable patterns for infrastructure agents.
This post explains what the Nightly Brainstorm does, how to set it up, and why it's worth the effort. If you're running Reef or building a similar infrastructure agent, this pattern should be in your toolkit.
What It Does
The agent reads log files, error rates, and resource usage trends. It doesn't just summarize — it analyzes. The LLM correlates events: "Error rate up 15% since Tuesday. Correlates with new getting it running. Suggest rollback or investigate." "Disk growth rate suggests log rotation needed in 2 weeks." "Memory usage trending up 2% per day. Possible leak." Actionable insights, not raw data. The human gets a report that says what to look at and why, not a dump of log lines.
The key is the 4 AM timing. By the time the team arrives at 9, the report is ready. No one has to dig through logs first thing. The agent has done the triage.
The Flow
Every night at 4 AM, a Heartbeat triggers Reef. The prompt instructs: "Review logs from the past 24 hours. Identify: (1) error rate trends, (2) resource usage anomalies, (3) correlation with deployments or config changes, (4) recommended actions. Output a structured report." Reef reads from configured log sources — files, Loki, CloudWatch, whatever you've connected. It aggregates. The LLM analyzes. The output is written to memory. Optionally, Reef sends a Slack message with the top 3 findings. When the admin opens their laptop, the report is there. They decide what to act on.
Output Format
The report is structured: findings, severity (high/medium/low), recommended actions. Example:
## Nightly Brainstorm — 2026-02-19
### High
- Error rate up 15% since Tue. Correlates with v2.3 deploy. Recommend: rollback or investigate new code path.
### Medium
- Disk growth: 12GB/day. At current rate, full in 14 days. Recommend: adjust log rotation.
### Low
- Memory usage +2% over 7 days. Monitor for leak.Stored in memory for reference. The human can ask Reef: "What did last night's brainstorm find?" and get the full context. The optional Slack message is a digest — "3 items need attention" — so the admin knows to look without opening the full report.
Value
Catches trends before they become pages. Proactive vs reactive. One admin put it this way: "Reef told me about the memory leak before users noticed. Fixed it on a Tuesday instead of a 3 AM Saturday." That's the ROI. Incidents are expensive — lost sleep, firefighting, customer impact. The Nightly Brainstorm surfaces problems when they're small. You fix them in business hours. You don't wait for the outage.
Another team: "We used to discover disk full at 2 AM. Now Reef flags it 2 weeks out. We've had zero disk-related incidents since we turned on the Brainstorm." The pattern pays for itself in avoided incidents.
How to Set It Up
Configure a Heartbeat with a 4 AM cron. The prompt should instruct Reef to: (1) read logs from the past 24h, (2) compute error rates and resource trends, (3) correlate with deployment history if available, (4) output a structured report. Store the report in memory. Optionally, add a step to post the top N items to Slack. The exact prompt depends on your log format and what you care about. Start simple: error rate and disk. Add memory, latency, and deployment correlation as you refine.
Common Pitfalls
Too much data: If you feed Reef 100GB of logs, the LLM will struggle. Aggregate first. Summarize error counts, not raw lines. Use log aggregation (Loki, CloudWatch) to pre-filter.
Noise: If everything is "high severity," nothing is. Tune the prompt to be selective. "Only flag if error rate increase > 10% or disk growth > 5GB/day."
Ignoring the report: The Brainstorm only helps if someone reads it. Make the Slack summary compelling. Or require a daily standup item: "What did Reef find last night?"
Wrapping Up
Nightly Brainstorm is a flagship Reef pattern. It turns raw logs into actionable intelligence. Proactive, not reactive. See Reef for the full agent setup. If you're running infrastructure, add this to your routine. Your future self will thank you.