/alibabacloud-pai-eas-service-diagnose

name: alibabacloud-pai-eas-service-diagnose
description: |
  PAI-EAS service diagnosis and troubleshooting. Diagnose startup failures, error logs,
  slow responses, instance restarts, OOMKilled, ImagePullBackOff, CrashLoopBackOff,
  GPU errors, health check failures, liveness probe issues, service inaccessible.
  
  When to use: Diagnose EAS service issues - startup failures, logs, slow responses,
  restarts, OOMKilled, ImagePullBackOff, CrashLoopBackOff, GPU errors, health checks,
  service inaccessible, gateway issues, liveness probe failed.
  Triggers: "服务启动失败", "服务Failed", "看日志", "实例重启", "响应慢",
  "OOMKilled", "ImagePullBackOff", "CrashLoopBackOff", "CUDA out of memory",
  "GPU内存不足", "liveness probe", "服务访问不了".
  
  Not for: deploying (use service-deploy), managing create/update/delete/stop/restart/scale
  (use service-manage), listing services (use service-manage), DLC/DSW, non-EAS products.
license: Apache-2.0
metadata:
  version: "1.0.0"
  domain: aiops
  owner: pai-eas-team
  contact: pai-eas-agent@alibaba-inc.com
  tags:
    - pai-eas
    - diagnosis
    - troubleshooting
    - log-analysis
    - service-health
  required_tools:
    - aliyun
    - jq
  required_permissions:
    - "eas:DescribeService"
    - "eas:DescribeServiceLog"
    - "eas:DescribeServiceEvent"
    - "eas:DescribeServiceDiagnosis"
    - "eas:DescribeServiceInstanceDiagnosis"
    - "eas:ListServiceInstances"
    - "eas:ListServiceContainers"
    - "eas:ListServices"
    - "eas:DescribeResource"
    - "eas:DescribeGateway"

PAI-EAS Service Operations Diagnosis

Helps users diagnose issues with running PAI-EAS services.

> **🔴🔴 [MUST — READ BEFORE ANYTHING ELSE] Two failure modes that cause task failure:** > > 1. **Listing is NOT diagnosing.** After `ListServices`/`list-services` returns > the target service, you MUST immediately continue and run the FULL diagnostic > workflow (`DescribeService` → `DescribeServiceEvent` → `DescribeServiceLog` > multi-keyword → `ListServiceInstances` → `ListServiceContainers` → > `DescribeServiceDiagnosis`) on a chosen service. NEVER stop after listing. > 2. **Always finish with an analysis section.** Every diagnosis MUST end with a > written health-analysis + recommendation section. If the user described a > symptom (e.g. "CUDA out of memory") that the live data does NOT show, you > MUST still add a secondary section explaining common causes and fixes for > that described symptom. Never end the turn with only raw command output.

---

Installation

Install the Aliyun CLI (>= 3.3.3, required baseline for plugin ecosystem compatibility) using a trusted package manager. On macOS, use Homebrew:

brew install aliyun-cli
aliyun version

On other platforms, download the versioned release tarball directly from `https://aliyuncli.alicdn.com/`, verify its checksum, and extract it manually before use (see the [CLI Installation Guide](references/cli-installation-guide.md)). Do not pipe remote scripts directly into a shell.

Verify CLI version >= 3.3.3, then enable automatic plugin installation and update plugins:

aliyun configure set --auto-plugin-install true
aliyun plugin update

User-Agent Setup

Before running any commands, generate the per-session `SESSION_ID` (see the Observability section) and build the unified user-agent string that embeds it. Pass this string via the `--user-agent` parameter on every CLI command:

# Generate once per session (32-char lowercase hex), reuse for every call
SESSION_ID=$(openssl rand -hex 16)
UA="AlibabaCloud-Agent-Skills/alibabacloud-pai-eas-service-diagnose/${SESSION_ID}"
aliyun plugin update

> **Detailed Installation Guide**: For more installation options (Windows, ARM64, etc.), see [CLI Installation Guide](references/cli-installation-guide.md).

---

Observability

All CLI, SDK, and Terraform calls made by this skill MUST carry a unified user-agent (UA) so that requests can be traced back to this skill and to a single session.

**UA template declaration (placeholder form):**

--user-agent AlibabaCloud-Agent-Skills/{SKILL_NAME}/{session-id}

• `{SKILL_NAME}` — the fixed skill identifier: `alibabacloud-pai-eas-service-diagnose`
• `{session-id}` — a per-session trace id (see rule below)

**session-id generation rule:**

1. Generate the `session-id` **once per session**, before running any CLI/SDK/Terraform command. 2. It MUST be a **32-character lowercase hexadecimal** string (128-bit), e.g. generated via:

   SESSION_ID=$(openssl rand -hex 16)   # 32 hex chars

3. Reuse the **same** `session-id` for **every** call in the session — CLI (`--user-agent`), SDK (UA/client config), and Terraform (`ALIBABACLOUDSTACK_UA` / provider `ua`), so all requests in one session share a single trace id. 4. Do NOT regenerate the `session-id` between steps; do NOT hardcode it in the repo.

**Applying the UA (pass `--user-agent` on every CLI command):**

# Generate once per session
SESSION_ID=$(openssl rand -hex 16)
UA="AlibabaCloud-Agent-Skills/alibabacloud-pai-eas-service-diagnose/${SESSION_ID}"

# Pass it on every command, e.g.:
aliyun eas describe-service --cluster-id <region> --service-name <service> \
  --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-pai-eas-service-diagnose/${SESSION_ID}"

For SDK calls, set the same `UA` string as the client user-agent; for Terraform, export it via the provider user-agent configuration. The `{SKILL_NAME}` and `{session-id}` segments MUST be identical across all three surfaces.

---

Environment Variables

No additional environment variables required. Alibaba Cloud credentials are managed via `aliyun configure`.

---

Authentication

> **Security Rules:** > - **NEVER** read, echo, or print AK/SK values > - **NEVER** ask the user to input AK/SK directly > - **NEVER** use `aliyun configure set` with literal credential values > - **ONLY** use `aliyun configure list` to check credential status