/alibabacloud-ecs-reboot-or-crash-diagnosis

name: alibabacloud-ecs-reboot-or-crash-diagnosis
description: Diagnose ECS instance reboot or crash issues. First checks for abnormal maintenance events, then uses Cloud Assistant to check for internal restarts or kernel panics. Use this skill when users report ECS instance unexpected reboot, crash, abnormal shutdown, kernel panic, or OOM. Supports vmcore file analysis, kdump configuration, system log analysis, and Windows crash dump analysis.
metadata:
  pattern: pipeline
  steps: "5"
  required_params: "instance_id, region_id"
  domain: aiops
  owner: ecs-team
  contact: ecs-agent@alibaba-inc.com
  ai-mode: disabled

ECS Instance Reboot/Crash Diagnosis

Diagnose root cause of ECS instance unexpected reboot or crash. Uses standard workflow: check platform maintenance events first, then check internal system logs. Supports both Linux and Windows systems.

Required Parameters

Before starting diagnosis, **must** obtain the following parameters from user:

| Parameter | Description | Example | |------|------|------| | `INSTANCE_ID` | ECS instance ID | `i-bp1a2b3c4d5e6f7g8h9j` | | `REGION_ID` | Region ID | `cn-hangzhou` |

**If user does not provide any of the above parameters, must ask user first. Do not start diagnosis.**

Mandatory Execution Rules

1. **Must obtain parameters first** — Instance ID and Region ID are required. Must ask user if missing. 2. **Standard workflow cannot be skipped** — Must execute in order: Maintenance Event Check → OSType Detection → System Log Check 3. **Must check Cloud Assistant status before diagnostics** — Before executing Step 3A/3B, must verify Cloud Assistant is running via `DescribeCloudAssistantStatus`. If not running, provide alternative diagnostic approaches. 4. **All diagnostic conclusions must be based on actual data** — No fabrication, speculation, or assumptions 5. **Output format must be strictly followed** — After diagnosis, **must read the complete template in `references/output-format.md`**, output strictly according to template structure. No free-form output, no omitted sections, no changed hierarchy. Every placeholder `{...}` in the template must be filled with actual data.

---

Prerequisites

CLI Tools

• **aliyun-cli 3.3.3+** (required) — For calling Alibaba Cloud API
• Installation & configuration: see [CLI Installation Guide](../../cli-installation-guide.md)

AI-Mode Configuration (Required)

Before using aliyun CLI commands, must configure AI-Mode:

# Enable AI-Mode
aliyun configure ai-mode enable

# Set user-agent for skill identification
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ecs-reboot-or-crash-diagnosis"

# Update plugins
aliyun plugin update

**After diagnosis complete, disable AI-Mode:**

aliyun configure ai-mode disable

Alibaba Cloud Credentials

Credentials must be pre-configured **outside of agent session**. Agent only verifies:

aliyun configure list

Instance Requirements

• **Cloud Assistant client must be installed and running** on the instance
• Alibaba Cloud Linux: Pre-installed by default
• Ubuntu/CentOS/Other: May require manual installation, check with `DescribeCloudAssistantStatus` API
• Installation guide: https://help.aliyun.com/document_detail/64930.html
• Instance status must be Running
• **Note:** If Cloud Assistant is not running, diagnostic commands cannot be executed remotely. Must provide manual diagnostic steps to user.

---

Required RAM Permissions

See **[RAM Policies](references/ram-policies.md)** for the complete permission list and custom policy example.

---

Step 1: Confirm Instance Information (Cannot Skip)

**Verify instance exists and get basic information:**

aliyun ecs describe-instances \
  --biz-region-id <REGION_ID> \
  --region <REGION_ID> \
  --instance-ids '["<INSTANCE_ID>"]'

Confirm from returned JSON:

• `RegionId` — Region ID (matches user provided)
• `Status` — Instance status (Running/Stopped)
• `InstanceName` — Instance name
• `OSType` — Operating system type (**windows / linux**)

**Record OSType for Step 3 branch selection.**

---

Step 2: Check ECS Maintenance Events

**Query instance historical system events to determine if platform maintenance caused reboot:**

aliyun ecs describe-instance-history-events \
  --biz-region-id <REGION_ID> \
  --region <REGION_ID> \
  --instance-id <INSTANCE_ID> \
  --event-cycle-status Executed

**Event Analysis:**

| Event Type | Meaning | Determination | Next Step | |---|---|---|---| | `SystemMaintenance.Reboot` | Reboot caused by system maintenance | Platform-initiated maintenance | Inform user, no further investigation needed | | `SystemFailure.Reboot` | Reboot caused by underlying hardware/system failure | Platform infrastructure failure | Suggest instance migration or contact support | | `InstanceFailure.Reboot` | Reboot caused by instance-level failure | **Instance internal issue detected by platform** | **Must continue to Step 3 for system log check** | | `InstanceExpiration.Stop` | Instance stopped due to expiration | Billing issue | Need renewal, no further investigation | | No relevant events | No platform maintenance events found | Not platform-initiated | Continue to Step 3 |

**Important Notes for InstanceFailure.Reboot:**

• This event indicates the platform detected an instance-level anomaly and triggered automatic recovery
• Common causes: kernel panic, OOM, system hang, critical process failure
• **Must execute Step 3** to check system logs for root cause
• Even if no obvious errors in logs, the instance may have been unresponsive at kernel level

**If maintenance event found:**

• Clearly inform user of reboot cause (event type, time, reason)
• Provide handling suggestions
• End diagnosis flow

**If no maintenance event found:**

• Continue to Step 3, check internal system logs based on OSType

---

Step 3A: Linux System Diagnosis (Execute when OSType is linux)

Ste