/alibabacloud-aes-sysom-os-diagnosis

name: alibabacloud-aes-sysom-os-diagnosis
description: |
  Perform SysOM deep OS-level diagnosis on Alibaba Cloud ECS instances to identify
  root causes of performance issues (CPU spikes, memory leaks, IO latency, etc.).
  Use when users report ECS instance performance problems, need kernel-level
  troubleshooting, or want to set up continuous automated diagnosis with instance
  enrollment and DingTalk alert notifications.

alibabacloud-aes-sysom-os-diagnosis

> **Skill Name**: alibabacloud-aes-sysom-os-diagnosis > **Goal**: Perform SysOM deep OS-level diagnosis on Alibaba Cloud ECS instances, with optional instance enrollment and DingTalk alert configuration.

---

Credential Security

> **[CRITICAL] Credential Security Rules:** > - **NEVER** print, echo, or display AccessKey ID / AccessKey Secret values in conversation or command output (even partial masking of `LTAI_ACCESS_KEY_ID` is FORBIDDEN) > - **NEVER** ask the user to input AK/SK directly in the conversation or command line > - **NEVER** use `aliyun configure set` with literal credential values > - **ONLY** use `aliyun configure list` to check credential status > > ```bash > aliyun configure list --user-agent AlibabaCloud-Agent-Skills > ``` > Check the output for a valid profile (AK, STS, or OAuth identity). > > **If no valid profile exists, STOP here.** > 1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak) > 2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile) > 3. Return and re-run after `aliyun configure list --user-agent AlibabaCloud-Agent-Skills` shows a valid profile

---

RAM Policy

For the full list of RAM permissions required by this skill, see [references/ram-policies.md](references/ram-policies.md).

> **[MUST] Permission Failure Handling:** When any command or API call fails due to permission errors at any point during execution, follow this process: > 1. Read `references/ram-policies.md` to get the full list of permissions required by this SKILL > 2. Use `ram-permission-diagnose` skill to guide the user through requesting the necessary permissions > 3. Pause and wait until the user confirms that the required permissions have been granted

---

Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call, > ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks, > passwords, domain names, resource specifications, etc.) MUST be confirmed with the > user. Do NOT assume or use default values without explicit user approval.

| Parameter | Required/Optional | Description | Default Value | |-----------|-------------------|-------------|---------------| | `region` | Required | Region of the ECS instance (e.g., `cn-hangzhou`) | None, must be provided by user | | `instance_id` | Required | ECS instance ID (e.g., `i-bp1xxxxxxxx`) | None, must be provided by user | | `ocd_description` | Optional | Problem description (English only, e.g., `high_cpu`) | `""` | | `start_time` | Optional | Diagnosis start timestamp (Unix seconds) | `0` (real-time) | | `end_time` | Optional | Diagnosis end timestamp (Unix seconds) | `0` | | `enable_diagnosis` | Optional | Force real-time diagnosis (highest priority) | `false` | | `uid` | Optional | Account ID owning the instance | `None` | | `skip_support_check` | Optional | Skip instance support check (speeds up workflow) | `false` | | `cluster_id` | Optional | ACK cluster ID (required for cluster enrollment) | None |

---

Core Workflow

The workflow has four phases with 14 steps. All `aliyun` CLI commands **MUST** include `--user-agent AlibabaCloud-Agent-Skills`.

Phase 1: Environment Setup (Steps 0–3)

**Step 0 — Enable AI-Mode and Update Plugins**

Before executing any CLI commands, enable AI-Mode, set User-Agent, and update plugins:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-aes-sysom-os-diagnosis"
aliyun plugin update

> **⚠️ The above three commands must be executed before all CLI operations, and only need to be run once.**

**Step 1 — CLI Version Check**

aliyun version --user-agent AlibabaCloud-Agent-Skills

Verify version >= 3.3.1. If not met, refer to `references/cli-installation-guide.md` for installation.

**Step 2 — Enable Auto Plugin Installation**

aliyun configure set --auto-plugin-install true --user-agent AlibabaCloud-Agent-Skills

**Step 3 — Credential Verification**

aliyun configure list --user-agent AlibabaCloud-Agent-Skills

If no valid credentials exist, **STOP** and guide the user to configure credentials outside the session.

---

Phase 2: Diagnosis Execution (Steps 4–9)

For detailed workflow, see [references/diagnose-workflow.md](references/diagnose-workflow.md).

**Step 4 — Ambiguous Problem Clarification (Inversion Gate)**

Must confirm `region` and `instance_id`. If not provided by the user, ask explicitly. Also extract optional `ocd_description` (must be translated to English), time range, etc.

> **⚠️ Time Inference Rule**: When the user's description contains **any temporal reference** (e.g., "this morning", "yesterday afternoon", "around 3pm", "last night"), you **MUST** proactively ask for the specific time range and recommend **historical diagnosis mode**. Do NOT silently default to real-time diagnosis when the problem clearly occurred in the past.

**Step 5 — Cloud Assistant Online Check**

aliyun ecs describe-cloud-assistant-status --biz-region-id <region> --instance-id <instance_id> --user-agent AlibabaCloud-Agent-Skills

Check if `CloudAssistantStatus` is `true` in the response. If offline, terminate the pipeline.

**Step 6 — SysOM Role Initialization**

aliyun sysom initial-sysom --check-only false --source aes-skills --user-agent AlibabaCloud-Agent-Skills

**Step 7 — Instance Support Ch