drt-analyze

Analyzes DRT CockroachDB cluster health by correlating Datadog metrics, logs, and operations timelines.

32.4k|4.1k|Updated Feb 6, 2014
One-click install
npx skills add https://github.com/cockroachdb/cockroach --skill drt-analyze
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: drt-analyze
Source: https://github.com/cockroachdb/cockroach/tree/main/.claude/skills/drt-analyze
Command: npx skills add https://github.com/cockroachdb/cockroach --skill drt-analyze

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Investigating DRT cluster health requires manually querying dozens of CockroachDB metrics, searching logs, and reconstructing which disruptive operations ran — then figuring out whether anomalies are real bugs or expected side-effects of chaos operations. This Skill automates that entire workflow and produces an evidence-backed health report.

Core Features & Use Cases

  • Parallel Health Analysis: Launches three agents to reconstruct the operations timeline from Datadog events, check 10 batches of CockroachDB metrics (availability, latency, storage, changefeeds, jobs, goroutines, admission control, LSM, KV prober), and search logs for panics, OOMs, disk stalls, and novel error patterns.
  • Correlation & Root Cause Grouping: Matches findings against disruptive operation windows using an operation-to-expected-impact mapping, distinguishing expected side-effects from real bugs, and groups findings into incidents by root cause.
  • Interactive Drill-Down: Supports follow-up investigation of individual findings using structured protocols with causal-chain metrics and log search terms.
  • Use Case: Ask "what happened on drt-scale-300 in the last 4 hours" and receive a tiered HEALTHY/DEGRADED/UNHEALTHY report with severity-classified findings linked to the operations that caused them.

Quick Start

Ask the assistant to analyze DRT cluster health, for example: run drt-analyze with cluster drt-scale-300 from now-4h to now.

Frequently Asked Questions about drt-analyze

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check DRT CockroachDB cluster health?

Invoke the analysis with a cluster name and time range, such as cluster drt-scale-300 from now-4h to now. The skill queries Datadog events, metrics, and logs in parallel, then produces a tiered health report classifying the cluster as HEALTHY, DEGRADED, or UNHEALTHY.

How do I tell if a metric spike is a real bug or an expected operation side-effect?

The skill correlates each finding's start time against disruptive operation windows and checks whether the metric is in that operation's expected impact set. Findings inside a window with expected metrics that recovered are marked expected; anything else is classified by severity independently.

What CockroachDB metrics does the DRT health analysis check?

It queries ten metric batches covering range availability, liveness heartbeats, SQL latency and failures, CPU, memory, disk capacity, storage write stalls, changefeed health, backup and restore jobs, goroutines, admission control, L0 sublevels, and KV prober results, each with defined WARNING and CRITICAL thresholds.

Why does the DRT analysis reject time windows over 24 hours?

Datadog averages data into multi-hour bins at that scale, which reduces spike detection accuracy and truncates the operations timeline. The skill recommends narrowing to 4-24 hour windows, with 4-hour windows giving roughly one-minute data point granularity.

What prerequisites are needed to run a DRT cluster analysis?

You need Datadog authentication via roachdev datadog auth login, verifiable with roachdev datadog auth status. If authentication fails during analysis, the skill stops and asks you to re-authenticate before continuing.

Can I drill down into a specific finding after the health report?

Yes. Asking for details on a finding launches an investigation subagent that re-queries the metric per node, follows a causal chain of related metrics, searches logs in the finding's window, and reports a hypothesis with confidence level and evidence.