AI-Assisted Linux Incident Triage with Bash and Claude Code: Building an Agentic DevOps Workflow

2026-07-26 · Source: Artificial Intelligence on Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cloud Computing & IT Infrastructure · Depth: Intermediate, medium

Summary

This article details the construction of an AI-assisted Linux incident triage system designed for agentic DevOps workflows, emphasizing human oversight. The system, built on Ubuntu Server, Bash scripting, Nginx, and Claude Code, implements a "Gather → Analyze → Human Act → Verify" operational model. It functions as a read-only health assessment tool, collecting Linux and Nginx health data, using AI for analysis, and preventing AI from initiating infrastructure changes. Key steps include establishing a healthy baseline, defining AI context via a "CLAUDE.md" file, planning five core health checks (Nginx Service, Port 80, HTTP Response, Disk Usage, Memory Availability), and developing a "linux-triage.sh" Bash script. This script generates a consolidated health report, which is then used by a Claude Code Skill with restricted read-only permissions. The workflow is validated by simulating an Nginx service failure, where Claude analyzes the incident and suggests recovery, but human operators perform the actual manual recovery and verification.

Key takeaway

For DevOps Engineers building incident response systems, prioritize an agentic AI approach that keeps humans in control. Implement read-only AI assistance for evidence gathering and analysis, ensuring AI never directly modifies production systems. You should define clear operational boundaries and safety rules for your AI agents, like restricting tool permissions to read-only actions. This strategy reduces operational risk and maintains human accountability for critical recovery actions, fostering safer and more reliable production operations.

Key insights

Agentic AI in DevOps should assist with evidence-based analysis and recommendations, leaving critical operational decisions and execution to human engineers.

Principles

• Agentic AI must assist, not automate, critical operational decisions.
• Separate AI analysis from human execution for safety.
• Explicitly define AI's operational boundaries and safety rules.

Method

The proposed agentic loop for incident triage follows a four-stage workflow: Gather evidence, Analyze with AI, Human Act for recovery, and Verify the outcome.

In practice

• Use a "CLAUDE.md" file to define AI context and safety rules.
• Implement read-only Bash scripts for evidence collection.
• Restrict AI tool permissions to prevent write operations.

Topics

• Agentic AI
• DevOps Workflows
• Linux Incident Triage
• Bash Scripting
• Claude Code
• Operational Risk

Best for: MLOps Engineer, DevOps Engineer, AI Engineer

Related on AIssential

• The End of CI/CD Pipelines: The Dawn of Agentic DevOps — Agentic DevOps delegates judgment to AI, automating complex tasks beyond traditional scripting but introducing novel failure modes.
• Build an agentic incident triage assistant with Amazon Quick and New Relic — An AI agent can automate incident triage by integrating observability and task management tools into a single conversational workflow.
• Inside the Shift to Agentic IT Ops - with Assaf Resnick of BigPanda — Agentic AI, powered by an IT knowledge graph, enables a prevention-first approach to IT operations.
• Building a Read-Only AI Agent for Storage Incident Response — A read-only AI agent can securely automate storage incident analysis, enhancing SRE and cloud observability.
• You Shipped an AI Agent to Production Without Testing It. So Did I — Layered testing and evaluation gates are crucial for safe AI agent deployment in high-liability workflows.
• Scaling cloud maturity with AI and AWS DevOps Agent: PwC — The AWS DevOps Agent uses agentic AI to unify telemetry, identify root causes, and automate incident response across hybrid cloud environments.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence on Medium.