System health

更新时间:
复制 MD 格式

The operating system health status uses key monitoring metrics to provide an overall view of the health of a cluster, node, or container, providing insights into the factors that affect system health. This topic describes how to use and interpret the health pages on the operating system console.

Limitations

  • Region limitations

    This feature is currently available only in China (Mainland) and China (Hong Kong).

  • Operating system limitations

    Architecture

    Operating system

    x86 architecture

    • Rocky Linux 9.5

    • Rocky Linux 9.1

    • Ubuntu 20.04

    • Alibaba Cloud Linux 3 Container Optimized Edition

    • Rocky Linux 8.8

    • Ubuntu 22.04

    • Alibaba Cloud Linux 3 Pro

    • Alibaba Cloud Linux 2/3

    • CentOS 7.6 or later, or CentOS 8

    • Anolis OS 7/8

    • Ubuntu 24.04

    ARM architecture

    • Alibaba Cloud Linux 3 Pro

    • Alibaba Cloud Linux 3

Prerequisites

  • If you are a RAM user, ensure that your Alibaba Cloud account (primary account) has granted the AliyunECSReadOnlyAccess and AliyunSysomFullAccess system policies to the RAM user.

  • The console permissions are enabled.

    When you log on to the operating system console for the first time, click Enable Service to enable the console service.

  • The SysOM component is installed. For installation instructions, see Component Management.

SysOM cluster and node health

An anomaly detection algorithm calculates the health score based on metrics from anomaly items. If you find that an anomaly reported by a check item does not align with your business scenario, you can use the Anomaly Feedback button to adjust the sensitivity of the anomaly detection algorithm for that check item.

System health

On the System Health page, the following panels display the real-time health score and resource data for the cluster associated with your primary account.

  • Cluster health score

    This panel displays the real-time health score of the current cluster. Health scores are categorized into the following levels:

    • Healthy: The systems of instances in the cluster are in a healthy state. This level indicates that the cluster may contain healthy or sub-healthy instances with Notice-level anomaly events, which have minimal or no impact on your workloads.

    • Sub-healthy: The systems of instances in the cluster are in a relatively healthy state. This level indicates that the cluster contains sub-healthy or unhealthy instances with Notice-level or Warning-level anomaly events. You should address these anomalies promptly and continue to monitor the health score trend. This state may have a minor impact on your workloads.

    • Unhealthy: The systems of instances in the cluster are in an unhealthy state. This level indicates that the cluster contains unhealthy or severely unhealthy instances with Warning-level or Critical-level anomaly events. You must address these anomalies immediately. The impact on your workloads is noticeable.

    • Severely Unhealthy: The systems of instances in the cluster are in a very unhealthy state. This level indicates that the cluster contains many severely unhealthy instances with numerous Warning-level or Critical-level anomaly events. You must address these anomalies immediately to prevent a severe impact on your workloads.

  • Cluster health metrics

    This panel displays scores for four types of metrics. You can use this data to identify which metric type is affecting the cluster's health score. The metrics are categorized as follows:

    • Saturation: Measures the load capacity of the operating system, typically expressed as the utilization rate of system resources, such as memory, CPU, and disk.

    • Latency: The time required for the operating system to process a specific request, such as task scheduling, memory allocation, I/O, or network operations.

    • Traffic: Statistics on the inbound and outbound data flowing through the system. This metric indicates the demand placed on the service. For an operating system, traffic can refer to network and I/O traffic.

    • Errors: The number of error requests or error events occurring in the operating system. It is typically a count, such as the number of OOM events, packet drop events, or system stalls.

  • Node count panel

    The number of managed nodes in the cluster that are in the Running state. The data reflects the past hour.

  • Cluster resource overview

    An overview of key resource usage across the cluster:

    • CPU: The CPU usage of the cluster.

    • Memory: The memory usage of the cluster.

    • Disk: The root file system usage of the cluster.

    • Network: The sum of the upload and download rates for all networks in the cluster.

Historical health details

Use the time selector to choose a specific time range. The historical health details section displays the cluster's health and anomaly status during that period.

  • Anomaly event analysis

    The Anomaly Event Analysis panel shows all anomaly check items that affect the health of the cluster or its instances.

    • You can use the drop-down list to filter anomaly events by level. The anomaly levels are described below.

      • Notice: Certain monitoring or system behavior metrics have reached a questionable state, which may indicate a potential risk. O&M personnel should closely monitor these metrics to take action before the situation worsens. Common examples include CPU usage approaching a threshold or a rising trend in memory usage.

      • Warning: Monitoring metrics have crossed a configured alert threshold, which may affect the normal operation of services. O&M personnel should promptly review and address the related issues.

      • Critical: A check item shows clear signs of an anomaly or failure, which could directly impact system availability and business continuity. O&M personnel must intervene immediately to investigate and resolve the problem.

    • Use the Instance ID drop-down list to filter for anomaly events on a specific instance.

    • Diagnosis Status

      • No Diagnosis: No diagnosis has been run for the current anomaly item. This can happen for the following reasons:

        • No diagnosis tool is available for the current anomaly item.

        • The automatic diagnosis feature is in a cooldown period.

        • The anomaly event ended before you viewed the page, which means the anomaly has already resolved.

      • Diagnosing: A diagnosis is in progress for the current anomaly item.

      • Diagnosis Completed: The diagnosis for the current anomaly item is complete. Click View Diagnosis Report in the Actions column to view the report.

      • Diagnosis Failed: The diagnosis call failed. A common reason is that multiple diagnosis requests were initiated on the node simultaneously.

    • Anomaly Feedback

      You can use the feedback mechanism to adjust the anomaly detection algorithm and optimize the sensitivity of an anomaly item. For example, if the system continuously reports node I/O traffic anomalies that you believe are false positives, you can click the Feedback button in the Actions column for one of the anomaly items and adjust the scope and sensitivity.

      • If you choose to apply the change only to the current node, the new sensitivity setting will apply to the node I/O traffic detection for the current instance.

      • If you choose to apply the change to all nodes in the cluster, the new sensitivity setting will apply to the I/O traffic detection for all nodes in the current cluster.

    • OS Copilot intelligent analysis

      The node CPU usage detection, node kernel-mode CPU usage detection, node soft interrupt CPU usage detection, node memory usage detection, node kernel memory usage detection, and node OOM stall prediction and detection check items integrate with OS Copilot. You can click the OS Copilot icon next to an anomaly item to ask the assistant to analyze the root cause. In the Anomaly Event Analysis table, supported check items display an OS Copilot icon. Click the icon to open a chat with predefined prompts. After sending a prompt, OS Copilot analyzes the problem and generates an analysis report in the chat window. The report includes a Problem Overview (instance ID, region, analysis time, and symptoms), Core Metric Analysis (such as a CPU usage distribution table), and Key Findings (such as analysis conclusions on kernel-mode CPU percentage and idle time).

  • Top 10 node health list

    The Top 10 Node Health List panel displays information for the 10 instances with the lowest health scores in the cluster, sorted from lowest to highest. Click Node Health in the Actions column to navigate to the corresponding instance's health page.

  • Health score trend

    Use the time selector to view the historical trends of the overall health score and the scores for the four metric types. This helps you identify historical health issues in the cluster.

    image

  • Node health proportion and node issue proportion

    • The Node Health Proportion chart shows the distribution of all nodes across four health levels.

      • Healthy: health score ≥ 90

      • Sub-healthy: 80 ≤ health score < 90

      • Unhealthy: 60 ≤ health score < 80

      • Severely Unhealthy: health score < 60

    • The Node Issue Proportion chart shows the distribution of issue types, including saturation, latency, traffic, and errors.

      image

Node health

Access the node health page

  1. Go to the operating system console.

  2. In the left-side navigation pane, click System Management.

  3. On the Managed tab, find the target instance by its Instance ID/Name, and then click Node Health in the Actions column.

Node health

The following panels display the real-time health score and resource data for the selected instance.

  • Node health score

    This panel displays the real-time health score of the selected instance. Health scores are categorized into the following levels:

    • Healthy: The instance's system or its Pods are in a healthy state. This level indicates that the instance may have Notice-level anomaly events, which have minimal or no impact on your workloads.

    • Sub-healthy: The instance's system or its Pods are in a relatively healthy state. This level indicates that the instance has Notice-level anomalies or contains sub-healthy or unhealthy Pods, which may have a minor impact on your workloads.

    • Unhealthy: The node's system or its Pods are in an unhealthy state. This level indicates that the instance has Warning-level anomalies or contains unhealthy or severely unhealthy Pods. You must address these anomalies immediately. The impact on your workloads is noticeable.

    • Severely Unhealthy: The node's system or its Pods are in a very unhealthy state. This level indicates that the instance has Critical-level anomalies or contains severely unhealthy Pods. You must address these anomalies immediately to prevent a severe impact on your workloads.

  • Node health metrics

    This panel displays scores for four types of metrics for the selected instance. You can use this data to identify which metric type is affecting the instance's health score. The metrics are categorized as follows:

    • Saturation: Measures the load capacity of the operating system, typically expressed as the utilization rate of system resources, such as memory, CPU, and disk.

    • Latency: The time required for the operating system to process a specific request, such as task scheduling, memory allocation, I/O, or network operations.

    • Traffic: Statistics on the inbound and outbound data flowing through the system. This metric indicates the demand placed on the service. For an operating system, traffic can refer to network and I/O traffic.

    • Errors: The number of error requests or error events occurring in the operating system. It is typically a count, such as the number of OOM events, packet drop events, or system stalls.

  • Pod count panel

    The number of Pods deployed on the current instance that are in the Running state.

  • Node resource overview

    • CPU: The CPU usage of the node.

    • Memory: The memory usage of the node.

    • Disk: The root file system usage of the node.

    • Network: The sum of the upload and download rates for all networks on the node.

Historical health details

  • Node anomaly event analysis

    • The Node Anomaly Event Analysis panel displays all anomaly check items affecting the health of the instance or its Pods. You can use the drop-down list to filter for anomaly events of a specific level.

    • If Pods are deployed on the instance, you can use the Pod drop-down list to view anomaly events for Pods on the ECS instance. You can filter by Pod name and namespace.

    • You can use the drop-down list to filter anomaly events by level. The anomaly levels are described below.

      • Notice: Certain monitoring or system behavior metrics have reached a questionable state, which may indicate a potential risk. O&M personnel should closely monitor these metrics to take action before the situation worsens. Common examples include CPU usage approaching a threshold or a rising trend in memory usage.

      • Warning: Monitoring metrics have crossed a configured alert threshold, which may affect the normal operation of services. O&M personnel should promptly review and address the related issues.

      • Critical: A check item shows clear signs of an anomaly or failure, which could directly impact system availability and business continuity. O&M personnel must intervene immediately to investigate and resolve the problem.

    • Diagnosis Status

      • No Diagnosis: No diagnosis has been run for the current anomaly item. This can happen for the following reasons:

        • No diagnosis tool is available for the current anomaly item.

        • The automatic diagnosis feature is in a cooldown period.

        • The anomaly event ended before you viewed the page, which means the anomaly has already resolved.

      • Diagnosing: A diagnosis is in progress for the current anomaly item.

      • Diagnosis Completed: The diagnosis for the current anomaly item is complete. Click View Diagnosis Report in the Actions column to view the report.

      • Diagnosis Failed: The diagnosis call failed. A common reason is that multiple diagnosis requests were initiated on the node simultaneously.

    • Anomaly Feedback

      You can use the feedback mechanism to adjust the anomaly detection algorithm and optimize the sensitivity of an anomaly item. For example, if the system continuously reports node I/O traffic anomalies that you believe are false positives, you can click the Feedback button in the Actions column for one of the anomaly items and adjust the scope and sensitivity.

      • If you choose to apply the change only to the current node, the new sensitivity setting will apply to the node I/O traffic detection for the current instance.

      • If you choose to apply the change to all nodes in the cluster, the new sensitivity setting will apply to the I/O traffic detection for all nodes in the current cluster.

    • OS Copilot intelligent analysis

      The node CPU usage detection, node kernel-mode CPU usage detection, node soft interrupt CPU usage detection, node memory usage detection, node kernel memory usage detection, and node OOM stall prediction and detection check items integrate with OS Copilot. You can click the OS Copilot icon next to an anomaly item to ask the assistant to analyze the root cause. In the Anomaly Event Analysis table, supported check items display an OS Copilot icon. Click the icon to open a chat with predefined prompts. After sending a prompt, OS Copilot analyzes the problem and generates an analysis report in the chat window. The report includes a Problem Overview (instance ID, region, analysis time, and symptoms), Core Metric Analysis (such as a CPU usage distribution table), and Key Findings (such as analysis conclusions on kernel-mode CPU percentage and idle time).

  • Top 10 Pod health list

    • If Pods exist on the ECS instance, the Top 10 Pod Health List panel displays information for the 10 Pods with the lowest health scores, sorted from lowest to highest.

    • Details about the Pods are provided.

      • The Pod health score represents the lowest score of the Pod during the time range selected in the time selector.

      • Image shows the container image used by the Pod. A maximum of five container images are displayed. Status shows the current Status of the Pod (Running/Offline).

  • Health score trend

    Use the time selector to view the historical trends of the overall health score and the scores for the four metric types. This helps you identify historical health issues in the instance.

    image

  • Pod health proportion and Pod issue proportion

    • The Pod health proportion chart shows the distribution of all Pods on the current ECS instance across four health levels.

      • Healthy: health score ≥ 90

      • Sub-healthy: 80 ≤ health score < 90

      • Unhealthy: 60 ≤ health score < 80

      • Severely Unhealthy: health score < 60

    • The Pod issue proportion chart shows the distribution of issue types, including saturation, latency, traffic, and errors.

    image

Use cases

The following four typical cases demonstrate the end-to-end O&M workflow, from an initial drop in health score, through event detection, to final diagnosis and resolution.

Memory usage anomaly analysis

The health status feature includes two check items, node memory check and node kernel memory check, to monitor the memory usage of an ECS instance. The following scenarios, high shared memory usage and kernel module memory leaks, show the process from a healthy status to an anomaly event and the complete diagnosis workflow.

  1. An application requests a large amount of shared memory, or a kernel module has a memory leak vulnerability.

  2. You notice that the overall health score and the saturation score of a cluster or node have dropped to Sub-healthy or Unhealthy, either in the real-time health score panel or the health score trend chart. If the anomaly is ongoing, the real-time health score panel will reflect the score drop.

    If the anomaly occurred in the past, you can observe a drop in the saturation score and the overall health score during that period in the health score trend chart.

    5eecdaf48460cde5d6cbef7159ecbc100d30b04e630ed3da58e70b814913bc360a414d3de9277d871abf3af1cbd75249e054aa0343fa914449ea8b42075a3b38cd70f064823257e0410abc6a4a6e655e15b73a0857bd4ec7fc653b69905bac42

  3. In the Anomaly Event Analysis panel, find the anomaly event for the corresponding time period. For high shared memory usage, a system memory usage high event appears. For a kernel memory leak, both an ECS instance memory usage high event and an ECS instance kernel non-reclaimable Slab/reclaimable Slab/direct page allocation memory usage high event appear. Click the Diagnose button in the Actions column for the event. You will be redirected to the System Diagnosis page, where the corresponding diagnosis item and instance are pre-selected.

    An anomaly record appears in the Anomaly Event Analysis panel with the description High system memory usage, possibly with background memory reclamation, a Notice anomaly level, the Node memory util anomaly item, a Saturation anomaly type, and a Not diagnosed status. The Actions column provides a Diagnose button.

    You are then redirected to the System Diagnosis page. The appropriate Diagnosis Type and Diagnosis Item are pre-selected, and the target instance is pre-filled in the Instance ID field. The Diagnosis Records table below displays the diagnosis history, including the diagnosis item (such as Memory Panorama Analysis), diagnosis parameters, diagnosis time, and diagnosis status. After the diagnosis is complete, you can click View Report to see the results.

OOM stall prediction and analysis

The health status feature includes a check item for predicting instance OOM events. This check item calculates the probability of an OOM event by combining metrics such as the instance's memory usage, CPU usage, load, and IO Wait. It can also report past OOM events. The following scenarios, one where an OOM has already occurred and one where an OOM is imminent, demonstrate the end-to-end problem-solving process, from a drop in health status to an anomaly event and diagnosis.

  • Scenario: An OOM event has already occurred.

    • Because OOM events are often instantaneous, it is typically difficult to identify a score drop caused by an OOM event from the real-time health score of a cluster or node.

    • If an OOM anomaly occurred in the past, you can observe a drop in the errors score and the overall health score during that period in the health score trend chart.

      image

    • Find the OOM anomaly event in the Anomaly Event Analysis panel for the relevant time period. Click the Diagnose button in the Actions column to diagnose the OOM event. After the diagnosis is complete, the Actions column for the anomaly item will display View Diagnosis Report. Click it to view the detailed report.

  • Scenario: Predicting an OOM stall.

    • Because OOM stalls are often short-lived, it is typically difficult to identify a score drop caused by an OOM stall from the real-time health score of a cluster or node.

    • If an OOM stall occurred in the past, you can observe a drop in the errors score and the overall health score during that period in the health score trend chart.

      image

    • In the Anomaly Event Analysis panel, locate the OOM anomaly event for the corresponding time period. It may be accompanied by an ECS instance I/O traffic anomaly. The Description indicates that an OOM event occurred. Click the Diagnose button in the Actions column. You will be redirected to the System Diagnosis page, where the corresponding Diagnosis Item (Memory Panorama Analysis) and instance are pre-selected for diagnosis.

Scheduling delay jitter analysis

The health status feature includes a check item for node scheduling delay, which detects if a scheduling delay event has occurred on a node.

  1. A node experiences a scheduling delay.

  2. You notice that the overall health score and the latency score of a cluster or node have dropped to Sub-healthy or Unhealthy, either in the real-time health score panel or the health score trend chart. If the anomaly is ongoing, the real-time health score panel will reflect the score drop.

    If the anomaly occurred in the past, you can observe a drop in the latency score and the overall health score during that period in the health score trend chart.

    image

  3. Find the ECS instance scheduling delay event in the Anomaly Event Analysis panel for the corresponding time period.

  4. Click Diagnose to diagnose the scheduling delay jitter event. After the diagnosis is complete, the Actions column for the anomaly item will display View Diagnosis Report. Click it to view the detailed report.

Packet drop analysis

  1. You notice that the overall health score and the errors score of a cluster or node have dropped to Sub-healthy or Unhealthy, either in the real-time health score panel or the health score trend chart. If the anomaly is ongoing, the real-time health score panel will reflect the score drop.

    If the anomaly occurred in the past, you can observe a drop in the errors score and the overall health score during that period in the health score trend chart.

    image

  2. Find the ECS instance network packet drop anomaly event in the Anomaly Event Analysis panel for the corresponding time period.

  3. Click Diagnose to run a diagnosis for this packet drop event. After the diagnosis is complete, the Actions column for the anomaly item will display View Diagnosis Report. Click it to view the detailed report.

High system load analysis

System load is a key metric for measuring the current load and pressure on a system. It is defined as the total number of processes that are either being processed by the CPU or are waiting for CPU time over a period of time. Due to system complexity, the causes of high load can vary. You can identify anomalies by monitoring the one-minute load average and use system load diagnosis to analyze the cause and receive suggestions for resolution.

  1. The system load metric on a node fluctuates due to incorrect CPU pinning or contention for kernel resources such as network or I/O.

  2. You notice that the overall health score and the errors score of a cluster or node have dropped, either in the real-time health score panel or the health score trend chart. If the anomaly is ongoing, the real-time health score panel will reflect the score drop.

    If the anomaly occurred in the past, you can observe a drop in the errors score and the overall health score during that period in the health score trend chart, as shown in the following figure.

    image.png

  3. Find the high node load anomaly event in the Anomaly Event Analysis panel for the corresponding time period.

  4. Click Diagnose to run a diagnosis for this high load anomaly event. After the diagnosis is complete, the Actions column for the anomaly item will display View Diagnosis Report. Click it to view the detailed report.

Anomaly detection scope

Node

Check item

Detected anomaly

Saturation

Node CPU usage detection

CPU usage is high, approaching, or at its bottleneck.

Node kernel-mode CPU usage detection

High kernel-mode CPU usage, possibly accompanied by I/O issues, memory allocation requests, system latency, or soft-lockups.

Node soft interrupt CPU usage detection

High soft interrupt CPU usage, possibly accompanied by network or I/O traffic approaching its bottleneck.

Node memory usage detection

High memory usage, possibly accompanied by memory reclamation, direct reclamation, or OOM events.

Node kernel memory usage detection

Anomalous usage of kernel memory (SUnreclaim, alloc_page, SReclaimable).

Node file descriptor usage detection

High or near-exhausted file descriptor usage, which can lead to service unavailability.

Node root file system usage detection

High or near-exhausted root file system usage, including inodes.

Node cgroup leak detection

cgroup leaks.

Node socket usage detection

Sockets usage is high or near exhaustion.

Node TCP memory usage detection

TCP memory usage exceeds the pressure threshold or is approaching the maximum limit.

Node dentry count detection

High dentry count, which may trigger slab reclamation, system latency, or CPU spikes.

Node dentry_negative count detection

High dentry_negative count, which may cause slab bloat or performance issues.

Latency

Node scheduling delay detection

Scheduling delay.

Node network latency detection

Network latency.

Node disk write latency detection

Disk write latency.

Node disk read latency detection

Disk read latency.

Traffic

Node disk I/O traffic detection

Disk I/O utilization exceeds the threshold, accompanied by sudden I/O traffic spikes or bursts.

Node load average detection

Sudden load spikes or high load average, indicating a risk of a system stall.

Errors

Node OOM stall prediction and detection

High memory usage, increased risk of OOM, or an OOM stall has already occurred.

Node packet drop detection

Packet drops, which can cause network jitter.

Node down detection

The node is down.

Pod

Check item

Detected anomaly

Pod memory usage detection

High Pod memory usage, possibly accompanied by cgroup memory reclamation and OOM events.

Pod CPU usage detection

High Pod CPU usage or reaching its bottleneck.

Pod CPU throttling detection

CPU bursts or usage reaching the configured limit results in CPU throttling.

Pod OOM event detection

An OOM event occurred in the Pod.