Security audit
Security checks across malware telemetry and agentic risk
This skill is a coherent read-only DWS diagnostics tool, but it should be reviewed because it uses local cloud credentials and shell commands while producing reports that can include sensitive SQL and user activity.
Install only in an environment where the agent is allowed to use Huawei Cloud DWS read-only diagnostics credentials and where generated HTML reports may contain SQL text, usernames, query IDs, host/IP data, and workload patterns. Prefer least-privilege IAM, avoid passing AK/SK on command lines, protect the MCP config file, and do not store generated reports in shared or synced workspaces unless that content is approved for those readers.
**Return Format**: Success `{"code": 0, "data": [...]}`; Failure `{"code": -1, "message": "error description"}`. On failure, retry once; if still failing, use degradation path and mark as "unavailable" in the report.
**Key Fields per Metric**:
- **IOStat**: ctime, host_id, disk_name, io_data{util, await, r_await, w_await, r_s, w_s, read_iops, write_iops, rMB_s, wMB_s, read_throughput, write_throughput, avgrq_sz, avgqu_sz} → core I/O metrics
- **CpuStat**: ctime, host_id, cpu_data{usr, sys, idle, iowait} → iowait > 30% indicates significant I/O pressure
- **cpu_io_diagnose_detail**: ctime, host_id, active_queries[{query, query_id, userName, cpu_rate, state, inst_name, duration_ms}], io_stats{read_iops, write_iops, read_throughput, write_throughput} → I/O diagnosis details + active queries
- **business_concurrency**: ctime, concurrency_value, active_connections → business concurrency- Yes → Enter three-stage determination **Stage 1: Clear I/O Anomaly** — IOPS and throughput far below minimum specification? - SSD: rMB/s+wMB_s << 900MB/s and r/s+w/s << 8000/s - HDD: rMB/s+wMB_s << 250MB/s and r/s+w/s << 1000/s - Yes → Confirmed **I/O Anomaly** (definite hardware issue)
**Stage 1: Clear I/O Anomaly** — IOPS and throughput far below minimum specification? - SSD: rMB/s+wMB_s << 900MB/s and r/s+w/s << 8000/s - HDD: rMB/s+wMB_s << 250MB/s and r/s+w/s << 1000/s - Yes → Confirmed **I/O Anomaly** (definite hardware issue) **Stage 2: Clear I/O Overload** — IOPS or throughput exceeds maximum specification?
- Yes → Confirmed **I/O Anomaly** (definite hardware issue) **Stage 2: Clear I/O Overload** — IOPS or throughput exceeds maximum specification? - SSD: rMB/s+wMB_s > 3500MB/s or r/s+w/s > 20000/s - HDD: rMB/s+wMB_s > 800MB/s or r/s+w/s > 2000/s - Yes → Confirmed **I/O Overload** (distinguish throughput overload/IOPS overload/dual overload) - Only throughput exceeds maximum → I/O throughput overload
**Stage 2: Clear I/O Overload** — IOPS or throughput exceeds maximum specification? - SSD: rMB/s+wMB_s > 3500MB/s or r/s+w/s > 20000/s - HDD: rMB/s+wMB_s > 800MB/s or r/s+w/s > 2000/s - Yes → Confirmed **I/O Overload** (distinguish throughput overload/IOPS overload/dual overload) - Only throughput exceeds maximum → I/O throughput overload - Only IOPS exceeds maximum → IOPS overload
- **System disk I/O high** → pg_log logs / pg_audit audit logs / system-level tasks **I/O Type Determination** (for overload scenario routing): - wMB/s >> rMB/s → Write I/O dominant - rMB/s >> wMB/s → Read I/O dominant **Output**: io_scenario, io_type, phenomenon_distribution, is_gray_zone, gray_zone_result
**I/O Type Determination** (for overload scenario routing): - wMB/s >> rMB/s → Write I/O dominant - rMB/s >> wMB/s → Read I/O dominant **Output**: io_scenario, io_type, phenomenon_distribution, is_gray_zone, gray_zone_result
| Metric | Meaning | Threshold Judgment | |--------|---------|-------------------| | r/s, w/s | Read/Write IOPS | SSD upper limit 8000-20000/s; HDD sequential I/O upper limit 1000-2000/s, HDD random I/O upper limit 300-600/s (per RAID group) | | rMB/s, wMB/s | Read/Write throughput | SSD upper limit 900-3500MB/s; HDD sequential I/O upper limit 250-800MB/s, HDD random I/O upper limit 130-240MB/s (per RAID group) | | r_await, w_await | Average response time (ms) | Persistently > 100 indicates I/O bottleneck (occasional spikes are normal) | | avgrq-sz | Average request size (KB) | Normal ~200; < 30 with high IOPS → highly suspect fragmented I/O | | avgqu-sz | Average I/O queue depth | Persistently > 100 indicates severe I/O queue backlog, combined with await to judge I/O bottleneck |
| Scenario | Features | |----------|----------| | **I/O Throughput Overload** | rMB/s+wMB/s reaching RAID group upper limit + util persistently 99%/100% + await persistently > 100 | | **IOPS Overload** | r/s+w/s reaching RAID group upper limit + util persistently 99%/100% + await persistently > 100 | | **I/O Anomaly** | IOPS and throughput far below minimum specification + await persistently > 100 + avgqu-sz persistently > 100 + util persistently 99%/100% |
| Metric | Key Fields |
|--------|------------|
| IOStat | ctime, host_id, disk_name, io_data{util, await, r_await, w_await, r_s, w_s, read_iops, write_iops, rMB_s, wMB_s, read_throughput, write_throughput, avgrq_sz, avgqu_sz} → core I/O metrics |
| CpuStat | ctime, host_id, cpu_data{usr, sys, idle, iowait} → iowait > 30% indicates significant I/O pressure |
| cpu_io_diagnose_detail | Flat row structure: ctime, host_id, inst_name, username, cpu_rate, count, datname, io_read, io_write, query_id, query, duration_ms, state. Also contains io_stats: read_iops, write_iops, read_throughput, write_throughput |
| business_concurrency | ctime, concurrency_value, active_connections || Metric | Meaning | Threshold Judgment | |--------|---------|-------------------| | r/s, w/s | Read/Write IOPS | SSD upper limit 8000-20000/s; HDD sequential I/O upper limit 1000-2000/s, HDD random I/O upper limit 300-600/s (per RAID group) | | rMB/s, wMB/s | Read/Write throughput | SSD upper limit 900-3500MB/s; HDD sequential I/O upper limit 250-800MB/s, HDD random I/O upper limit 130-240MB/s (per RAID group) | | r_await, w_await | Average response time (ms) | Persistently > 100 indicates I/O bottleneck (occasional spikes are normal) | | avgrq-sz | Average request size (KB) | Normal ~200; < 30 with high IOPS → highly suspect fragmented I/O | | avgqu-sz | Average I/O queue depth | Persistently > 100 indicates severe I/O queue backlog, combined with await to judge I/O bottleneck |
| Scenario | Features | |----------|----------| | **I/O Throughput Overload** | rMB/s+wMB/s reaching RAID group upper limit + util persistently 99%/100% + await persistently > 100 | | **IOPS Overload** | r/s+w/s reaching RAID group upper limit + util persistently 99%/100% + await persistently > 100 | | **I/O Anomaly** | IOPS and throughput far below minimum specification + await persistently > 100 + avgqu-sz persistently > 100 + util persistently 99%/100% |
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.