Alibabacloud Aes Sysom Os Diagnosis

alibabacloud-aes-sysom-os-diagnosis

Skill Name: alibabacloud-aes-sysom-os-diagnosis

Goal: Perform SysOM deep OS-level diagnosis on Alibaba Cloud ECS instances, with optional instance enrollment and DingTalk alert configuration.

---

Credential Security

[CRITICAL] Credential Security Rules:

- NEVER print, echo, or display AccessKey ID / AccessKey Secret values in conversation or command output (even partial masking of LTAI_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list --user-agent AlibabaCloud-Agent-Skills

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list --user-agent AlibabaCloud-Agent-Skills shows a valid profile

---

RAM Policy

For the full list of RAM permissions required by this skill, see references/ram-policies.md.

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read references/ram-policies.md to get the full list of permissions required by this SKILL

2. Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions

3. Pause and wait until the user confirms that the required permissions have been granted

---

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks,

passwords, domain names, resource specifications, etc.) MUST be confirmed with the

user. Do NOT assume or use default values without explicit user approval.

---

Core Workflow

The workflow has four phases with 14 steps. All aliyun CLI commands MUST include --user-agent AlibabaCloud-Agent-Skills.

Phase 1: Environment Setup (Steps 0–3)

Step 0 — Enable AI-Mode and Update Plugins

Before executing any CLI commands, enable AI-Mode, set User-Agent, and update plugins:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-aes-sysom-os-diagnosis"
aliyun plugin update

⚠️ The above three commands must be executed before all CLI operations, and only need to be run once.

Step 1 — CLI Version Check

aliyun version --user-agent AlibabaCloud-Agent-Skills

Verify version >= 3.3.1. If not met, refer to references/cli-installation-guide.md for installation.

Step 2 — Enable Auto Plugin Installation

aliyun configure set --auto-plugin-install true --user-agent AlibabaCloud-Agent-Skills

Step 3 — Credential Verification

aliyun configure list --user-agent AlibabaCloud-Agent-Skills

If no valid credentials exist, STOP and guide the user to configure credentials outside the session.

---

Phase 2: Diagnosis Execution (Steps 4–9)

For detailed workflow, see references/diagnose-workflow.md.

Step 4 — Ambiguous Problem Clarification (Inversion Gate)

Must confirm region and instance_id. If not provided by the user, ask explicitly. Also extract optional ocd_description (must be translated to English), time range, etc.

⚠️ Time Inference Rule: When the user's description contains any temporal reference (e.g., "this morning", "yesterday afternoon", "around 3pm", "last night"), you MUST proactively ask for the specific time range and recommend historical diagnosis mode. Do NOT silently default to real-time diagnosis when the problem clearly occurred in the past.

Step 5 — Cloud Assistant Online Check

aliyun ecs describe-cloud-assistant-status --biz-region-id <region> --instance-id <instance_id> --user-agent AlibabaCloud-Agent-Skills

Check if CloudAssistantStatus is true in the response. If offline, terminate the pipeline.

Step 6 — SysOM Role Initialization

aliyun sysom initial-sysom --check-only false --source aes-skills --user-agent AlibabaCloud-Agent-Skills

Step 7 — Instance Support Check

aliyun sysom check-instance-support --instances <instance_id> --biz-region <region> --user-agent AlibabaCloud-Agent-Skills

Step 8 — Invoke Diagnosis and Poll Results

Diagnosis Mode Decision Rules

if enable_diagnosis == true:
    mode = real-time diagnosis    # enable_diagnosis has highest priority
elif start_time != 0:
    mode = historical diagnosis   # time range specified, retrospective analysis
else:
    mode = real-time diagnosis    # default

• Real-time: start_time=0, end_time=0
• Historical: start_time=<unix_ts>, end_time=<unix_ts>
• Forced real-time: when enable_diagnosis=true, force start_time to 0 even if provided

Build params JSON

Use snake_case keys (consistent with SDK). Required base fields (ALL must be included):

{
  "instance": "<instance_id>",
  "region": "<region>",
  "start_time": 0,
  "end_time": 0,
  "type": "ocd",
  "ai_roadmap": true,
  "enable_sysom_link": false
}

⚠️ Anti-confusion Warning: `"type": "ocd"` is a REQUIRED field inside the params JSON — do NOT omit it!

>

--service-name ocd (CLI argument) and "type": "ocd" (params JSON field) are two different levels of parameters, both are mandatory:

- --service-name ocd → tells CLI which diagnosis service endpoint to call

- "type": "ocd" → tells the diagnosis engine which diagnosis type to execute internally

>

Do NOT omit `"type": "ocd"` from params just because `--service-name` already specifies `ocd`!

Conditional fields (add only when non-empty):

• ocd_description: problem description in English (e.g., high_cpu)
• uid: account ID owning the instance (integer)

Invoke Diagnosis

aliyun sysom invoke-diagnosis \
  --service-name ocd \
  --channel ecs \
  --params '{"instance":"<instance_id>","region":"<region>","start_time":<start_time>,"end_time":<end_time>,"type":"ocd","ai_roadmap":true,"enable_sysom_link":false,"ocd_description":"<ocd_description>"}' \
  --user-agent AlibabaCloud-Agent-Skills

Extract task_id from the response. If Sysom.TaskInProgress error is returned, extract the existing task_id from the error message and proceed to polling.

Poll Results (interval: 10s, max: 60 attempts)

aliyun sysom get-diagnosis-result --task-id <task_id> --user-agent AlibabaCloud-Agent-Skills

Step 9 — Result Parsing and Output

Parse the returned JSON and present summary.overall_status, summary.root_cause, summary.suggestions, issues[], and other key information to the user.

---

Phase 3: Enrollment Recommendation (Steps 10–12)

For detailed workflow, see references/manage-and-alert-workflow.md.

Step 10 — Enrollment Recommendation and Intent Collection (Inversion Double Gate)

This step contains two strictly separated gates that MUST be executed in order — merging, skipping, or simplifying is FORBIDDEN.

10A — Prominent Enrollment Recommendation (First Gate)

⚠️ Mandatory Rule: After presenting diagnosis results, you MUST immediately output the following recommendation content verbatim. Do NOT abbreviate, omit, or rephrase in your own words.

Replace <instance_id> with the actual instance ID, then output the following content word-for-word:

<verbatim_output>

## 🔔 Recommendation: Enroll Instance for 24/7 Automated Diagnosis

>

The diagnosis just performed was a one-time manual operation. If you want SysOM to continuously protect this instance, we recommend instance enrollment.

>

### After enrollment, you will get:

>

- 🔍 Automated Diagnosis: When the instance experiences performance issues like CPU spikes, memory leaks, or IO latency, SysOM will automatically trigger deep diagnosis without manual intervention

- 📲 DingTalk Alerts: Diagnosis reports will be automatically pushed to DingTalk group bots, notifying the ops team immediately

- 🛡️ Continuous Monitoring: 24/7 uninterrupted protection, shifting from "investigate after problems occur" to "automatically told the root cause when problems occur"

>

Would you like to enroll instance `<instance_id>`?

</verbatim_output>

After outputting the above, STOP. Wait for user reply. Do NOT ask about enrollment method in 10A.

• User declines → end the pipeline
• User agrees → proceed to Step 10B

10B — Ask Enrollment Method (Second Gate)

Only after the user explicitly agrees in 10A, output the following (replace <instance_id> and <region> with actual values):

<verbatim_output>

### Please choose an enrollment method

>

A. Enroll current instance only

Only enroll the instance just diagnosed: <instance_id> (<region>)

>

B. Enroll ACK cluster

If this instance belongs to an ACK cluster, you can enroll all nodes in the cluster with one click.

Newly added nodes will be automatically enrolled — no manual action needed.

👉 Please provide the ACK Cluster ID (e.g., c9d7f3fc3d42********c1100ffb19d)

>

C. Enroll multiple specified instances

Batch enroll multiple instances.

👉 Please provide the instance list in the format InstanceID:Region, separated by spaces

Example: i-xxx:cn-beijing i-yyy:cn-hangzhou

>

Please choose A / B / C, or tell me your requirements directly.

</verbatim_output>

After outputting the above, STOP. Wait for user reply.

Step 11 — Execute Enrollment

Fixed parameter values for `--agent-id`, `--agent-version`, `--config-id` in enrollment commands are listed in the "Fixed Parameters" table in [references/related-commands.md](references/related-commands.md).

# Instance mode
aliyun sysom install-agent \
  --instances instance=<instance_id> region=<region> \
  --install-type InstallAndUpgrade \
  --agent-id <agent-id> \
  --agent-version <agent-version> \
  --user-agent AlibabaCloud-Agent-Skills

# Cluster mode
aliyun sysom install-agent-for-cluster \
  --cluster-id <cluster_id> \
  --agent-id <agent-id> \
  --agent-version <agent-version> \
  --config-id <config-id> \
  --user-agent AlibabaCloud-Agent-Skills

Step 12 — Enrollment Status Confirmation

# Instance mode — poll instance status (interval: 10s, max: 60 attempts)
aliyun sysom list-instance-status --instance <instance_id> --biz-region <region> --user-agent AlibabaCloud-Agent-Skills

# Cluster mode — get full cluster list, then match target cluster by cluster_id
aliyun sysom list-clusters --user-agent AlibabaCloud-Agent-Skills
# From the returned cluster list, match the target cluster by cluster_id field and check its cluster_status

⚠️ Enrollment success criteria: status `Running` means enrollment is complete — stop polling immediately and proceed to the next step.

---

Phase 4: Alert Configuration (Steps 13–15)

For detailed workflow, see references/manage-and-alert-workflow.md.

Step 13 — Collect DingTalk Webhook and Create Alert Destination (Inversion Gate + SDK Call)

After successful enrollment, you MUST immediately collect the DingTalk bot Webhook URL from the user to create an alert destination. This feature is NOT supported by CLI — use SDK scripts under scripts/.

Ask the user:

<verbatim_output>

📲 Please provide the DingTalk group bot Webhook URL for receiving alert notifications.

Format: https://oapi.dingtalk.com/robot/send?access_token=xxx

>

💡 How to get it: DingTalk Group Settings → Bot Management → Add Bot → Custom Bot → Optional keyword: alert → Copy Webhook URL

</verbatim_output>

After the user provides the Webhook, initialize the SDK environment and create the alert destination:

# Initialize SDK environment (first time only, can skip afterwards)
bash scripts/setup-sdk.sh

# Create alert destination (stdout outputs destination_id)
.sysom-sdk-venv/bin/python scripts/create-alert-destination.py '<user-provided-webhook-url>'

⚠️ You MUST use `.sysom-sdk-venv/bin/python` to execute scripts — using system python3 is FORBIDDEN (signature algorithm depends on specific SDK version).

On success, stdout outputs destination_id (a pure number). Record this value for use in Step 15.

Step 14 — Alert Item Selection (Inversion Gate)

aliyun sysom list-alert-items --user-agent AlibabaCloud-Agent-Skills

Display the alert items list (categorized by NODE/POD), supporting quick selection (all, node-all, pod-all) and numbered selection.

Step 15 — Create Alert Strategy (SDK Call)

After the user selects alert items, create the alert strategy directly with destinations set to the destination ID from Step 13.

⚠️ CLI does NOT support the `destinations` parameter — you MUST use the SDK script to create alert strategies.

.sysom-sdk-venv/bin/python scripts/create-alert-strategy.py \
  --name "aliyun-aes-skills-create-<YYYYMMDDHHmm>" \
  --items "<alert_item_1>,<alert_item_2>" \
  --clusters "<clusters_value>" \
  --destinations "<destination_id>"

• Instance mode → --clusters value is default
• Cluster mode → --clusters value is <cluster_name> (note: name, NOT ID)
• --destinations → destination ID from Step 13 (multiple IDs comma-separated, e.g., 1,2)
• --items → alert item names comma-separated

⚠️ You MUST use `.sysom-sdk-venv/bin/python` to execute scripts — using system python3 is FORBIDDEN.

---

Success Verification

For verification methods of each phase, see references/verification-method.md.

---

Cleanup

The diagnosis operations in this skill are read-only and do not modify instance state — no cleanup is needed.

To uninstall an enrolled Agent, use aliyun sysom uninstall-agent (see references/related-commands.md for parameters).

After all CLI operations are complete, you MUST disable AI-Mode:

aliyun configure ai-mode disable

---

Command Tables

For the full CLI command list, see references/related-commands.md.

---

Best Practices

1. Check Cloud Assistant status before diagnosis: SysOM diagnosis depends on Cloud Assistant being online — always confirm in Step 5 2. Use real-time diagnosis mode: Unless the user explicitly specifies a time range, default to real-time diagnosis 3. Use English keywords for ocd_description: API only supports [a-zA-Z0-9_.~-] characters 4. Use double gate for enrollment recommendation: Recommend first, then ask method — avoid information overload 5. Cluster enrollment batch limit: When exceeding 50 instances, the first batch installs only 50; the rest are installed automatically 6. clusters parameter for alert strategy: Use default for instance mode, use cluster name (not ID) for cluster mode 7. Alert destinations via SDK: Alert destination APIs are not supported by CLI — must use Python SDK (alibabacloud_sysom20231230) 8. destinations parameter for alert strategy: After creating an alert destination, include destinations (destination ID list) in create-alert-strategy — alerts will be pushed to DingTalk via SysOM 9. Credential security: Never print or echo AK/SK values in conversation 10. All CLI commands must include `--user-agent AlibabaCloud-Agent-Skills` 11. Remediation suggestions may involve high-risk operations: Follow the Human-in-the-loop protocol and wait for user confirmation

---

Unsupported Scenarios

• Non-Linux instances (Windows instances are not supported)
• Instances with incompatible kernel versions (checked via check-instance-support)
• Pure configuration issues (e.g., security group rules, VPC routing — no OS-level diagnosis needed)

---

Error Handling

---

Reference Links

Acceptance Criteria: alibabacloud-aes-sysom-os-diagnosis

Scenario: SysOM 深度诊断 — ECS 实例内核级性能诊断、纳管与告警配置 Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. Product — verify product name exists

✅ CORRECT

aliyun sysom invoke-diagnosis ...
aliyun ecs describe-cloud-assistant-status ...

❌ INCORRECT

# 错误：产品名不存在
aliyun SysOM invoke-diagnosis ...
aliyun sysom InvokeDiagnosis ...

2. Command — verify action exists under the product

✅ CORRECT

aliyun sysom invoke-diagnosis
aliyun sysom get-diagnosis-result
aliyun sysom initial-sysom --check-only false --source aes-skills
aliyun sysom check-instance-support
aliyun sysom install-agent
aliyun sysom install-agent-for-cluster
aliyun sysom list-instance-status
aliyun sysom list-clusters
aliyun sysom list-alert-items
aliyun sysom create-alert-strategy  # CLI 存在但不支持 destinations，需用 SDK 脚本
aliyun sysom uninstall-agent

❌ INCORRECT

# 错误：使用传统 API 格式而非 plugin mode
aliyun sysom InvokeDiagnosis
aliyun sysom GetDiagnosisResult
aliyun sysom InstallAgent

3. Parameters — verify each parameter name exists

✅ CORRECT

# invoke-diagnosis 参数（params key 使用 snake_case，必须包含 type）
aliyun sysom invoke-diagnosis --service-name ocd --channel ecs \
  --params '{"instance":"i-xxx","region":"cn-hangzhou","start_time":0,"end_time":0,"type":"ocd","ai_roadmap":true,"enable_sysom_link":false}'

# install-agent 参数
aliyun sysom install-agent --instances instance=i-xxx region=cn-hangzhou --install-type InstallAndUpgrade --agent-id xxx --agent-version 3.12.0-1

# describe-cloud-assistant-status 参数
aliyun ecs describe-cloud-assistant-status --biz-region-id cn-hangzhou --instance-id i-xxx

# list-instance-status 参数
aliyun sysom list-instance-status --instance i-xxx --biz-region cn-hangzhou

# list-clusters（不传 --cluster-id，获取全量后匹配）
aliyun sysom list-clusters

# create-alert-strategy（通过 SDK 脚本，CLI 不支持 destinations）
.sysom-sdk-venv/bin/python scripts/create-alert-strategy.py --name my-strategy --items "节点CPU使用率检测" --clusters "default" --destinations "1"

❌ INCORRECT

# 错误：参数名不正确
aliyun sysom invoke-diagnosis --serviceName ocd  # 应为 --service-name
aliyun sysom install-agent --instanceId i-xxx    # 应为 --instances instance=i-xxx region=xxx
aliyun ecs describe-cloud-assistant-status --region-id cn-hangzhou  # 应为 --biz-region-id
aliyun sysom check-instance-support --region cn-hangzhou  # 应为 --biz-region

# 错误：invoke-diagnosis params 使用 camelCase 或缺少 type
aliyun sysom invoke-diagnosis --params '{"instanceId":"i-xxx","startTime":0}'  # key 应为 snake_case，且缺少 type

# 错误：list-clusters 传入 --cluster-id（应获取全量后匹配）
aliyun sysom list-clusters --cluster-id cxxx  # 应不传参数，获取全量列表后按 cluster_id 匹配

5. Alert Destination SDK Calls — verify SDK usage patterns

✅ CORRECT

# SDK 环境初始化
bash scripts/setup-sdk.sh

# 创建告警联系人（通过脚本）
.sysom-sdk-venv/bin/python scripts/create-alert-destination.py 'https://oapi.dingtalk.com/robot/send?access_token=xxx'

# 创建告警联系人（指定名称）
.sysom-sdk-venv/bin/python scripts/create-alert-destination.py 'https://oapi.dingtalk.com/robot/send?access_token=xxx' '运维告警群'

❌ INCORRECT

# 错误：尝试通过 CLI 调用告警联系人 API（不支持 CLI）
aliyun sysom create-alert-destination ...  # 此命令不存在

# 错误：未先运行 setup-sdk.sh 就直接调用脚本
python scripts/create-alert-destination.py '...'  # 应使用虚拟环境中的 python

# 错误：直接用 pip install 而非 setup-sdk.sh（不会创建虚拟环境）
pip install alibabacloud_sysom20231230

4. --user-agent flag present

✅ CORRECT

aliyun sysom invoke-diagnosis --service-name ocd --channel ecs --params '...' --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# 错误：缺少 --user-agent
aliyun sysom invoke-diagnosis --service-name ocd --channel ecs --params '...'

---

Credential Verification Pattern

✅ CORRECT

aliyun configure list --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# 错误：打印 AK/SK 值
echo $ALIBABA_CLOUD_ACCESS_KEY_ID

# 错误：在命令行中传入明文凭据
aliyun configure set --access-key-id LTAI5tXXXXXX --access-key-secret 8dXXXXXXXX

---

Parameter Handling

✅ CORRECT

• 所有用户可定制参数（RegionId、instance_id 等）在执行前向用户确认
• ocd_description 使用纯英文关键词
• --instances 使用结构化格式 instance=<id> region=<region>

❌ INCORRECT

• 假设 region 为 cn-hangzhou 而不询问用户
• 将中文直接传入 ocd_description
• --instances 使用 JSON 数组格式而非结构化格式

---

CLI Plugin Mode Format

✅ CORRECT

aliyun sysom invoke-diagnosis    # 小写 + 连字符
aliyun sysom get-diagnosis-result
aliyun sysom install-agent

❌ INCORRECT

aliyun sysom InvokeDiagnosis     # 传统 API 格式
aliyun sysom GetDiagnosisResult
aliyun sysom InstallAgent

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.1+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.1 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.1)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.1+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

Diagnosis Execution Detailed Workflow

This document contains the detailed execution steps for SysOM deep diagnosis (Steps 4–9), referenced from the Core Workflow in SKILL.md.

All aliyun CLI commands MUST include --user-agent AlibabaCloud-Agent-Skills.

---

Step 4 — Ambiguous Problem Clarification (Inversion Gate)

Before entering the diagnosis pipeline, the following two required parameters MUST be confirmed. If the user's question does not include this information, you must ask the user — do NOT guess or use default values.

Required Parameters

Clarification Flow

4a. Check if the user's input already contains region and instance_id

Extract these two parameters from the user's problem description. Common expressions include:

• "instance i-bp1xxx in Hangzhou" (region=cn-hangzhou, instance_id=i-bp1xxx)
• "instance i-bp1xxx in Beijing" (region=cn-beijing, instance_id=i-bp1xxx)

4b. If either parameter is missing, ask the user

🔍 To perform SysOM deep diagnosis, I need to confirm the following:

>

- Instance ID: Please provide the ECS instance ID (format: i-bp1xxxxxxxx)

- Region: The Alibaba Cloud region where the instance is located (e.g., cn-hangzhou, cn-beijing, cn-shanghai)

4c. Also extract optional context

• ocd_description: The problem symptoms described by the user
• Time range inference (see below)
• uid: If the user mentioned an account ID

⚠️ CRITICAL: Time Inference and Historical Diagnosis Recommendation

When the user's description contains any temporal reference — even vague ones — you MUST proactively infer the time range and recommend historical diagnosis mode. Do NOT silently default to real-time diagnosis when the problem clearly occurred in the past.

Time inference examples:

Rules: 1. If the user mentions a past event (crash, reboot, spike that already happened), you MUST ask for the specific time and recommend historical diagnosis 2. If the user describes an ongoing issue ("right now", "currently"), use real-time diagnosis 3. When asking for time, also provide the option: "Or would you prefer a real-time diagnosis to check the current state?" 4. Convert natural language time references to Unix timestamps using the current time as reference

⚠️ IMPORTANT: `ocd_description` MUST be in English only

The SysOM API restricts ocd_description to only [a-zA-Z0-9_.~-] characters. You must translate the user's problem description into short English keywords connected by underscores.

---

Step 5 — Cloud Assistant Online Check

aliyun ecs describe-cloud-assistant-status \
  --biz-region-id <region> \
  --instance-id <instance_id> \
  --user-agent AlibabaCloud-Agent-Skills

Check the InstanceCloudAssistantStatusSet.InstanceCloudAssistantStatus array in the returned JSON, find the CloudAssistantStatus field for the target instance:

• "true" → Cloud Assistant is online, proceed to Step 6
• "false" → Inform user that Cloud Assistant is offline, terminate the pipeline
• API call failure → Ask user whether to continue

---

Step 6 — SysOM Role Initialization

aliyun sysom initial-sysom --check-only false --source aes-skills --user-agent AlibabaCloud-Agent-Skills

Ensures the SysOM service role has been created. This step is idempotent and can be executed repeatedly.

---

Step 7 — Instance Support Check

aliyun sysom check-instance-support \
  --instances <instance_id> \
  --biz-region <region> \
  --user-agent AlibabaCloud-Agent-Skills

Verify the target instance meets:

• Operating system is Linux
• Kernel version is compatible with SysOM diagnosis

If the instance is not supported, a clear failure reason is returned — suggest falling back to standard diagnosis.

---

Step 8 — Invoke Diagnosis and Poll Results

8a. Diagnosis Mode Decision

Based on the user's input parameter combination, determine the diagnosis mode:

if enable_diagnosis == true:
    mode = real-time diagnosis    # enable_diagnosis has highest priority, force start_time to 0
elif start_time != 0:
    mode = historical diagnosis   # time range specified, retrospective analysis
else:
    mode = real-time diagnosis    # default

Optional Parameters and Defaults

8b. Build params JSON

Use snake_case keys (consistent with SDK). Required base fields (ALL must be included):

{
  "instance": "<instance_id>",
  "region": "<region>",
  "start_time": 0,
  "end_time": 0,
  "type": "ocd",
  "ai_roadmap": true,
  "enable_sysom_link": false
}

⚠️ Anti-confusion Warning: `"type": "ocd"` is a REQUIRED field inside the params JSON — do NOT omit it!

>

--service-name ocd (CLI argument) and "type": "ocd" (params JSON field) are two different levels of parameters, both are mandatory:

- --service-name ocd → tells CLI which diagnosis service endpoint to call

- "type": "ocd" → tells the diagnosis engine which diagnosis type to execute internally

>

Do NOT omit `"type": "ocd"` from params just because `--service-name` already specifies `ocd`!

Conditional fields (add to JSON only when non-empty):

• "ocd_description": "<english_keywords>" — add when user's problem description is not empty
• "uid": <integer> — add when user provides an account ID

Impact of diagnosis mode on params:

• Real-time: start_time: 0, end_time: 0
• Historical: start_time: <unix_ts>, end_time: <unix_ts>
• Forced real-time (enable_diagnosis=true): force start_time to 0 even if user provided a value

8c. Invoke Diagnosis

aliyun sysom invoke-diagnosis \
  --service-name ocd \
  --channel ecs \
  --params '{"instance":"<instance_id>","region":"<region>","start_time":<start_time>,"end_time":<end_time>,"type":"ocd","ai_roadmap":true,"enable_sysom_link":false,"ocd_description":"<ocd_description>"}' \
  --user-agent AlibabaCloud-Agent-Skills

Extract task_id from the response.

Special handling: If Sysom.TaskInProgress error is returned, it means a diagnosis task is already in progress. Extract the existing task_id from the error message (regex match ocd(<task_id>)) and proceed directly to polling.

8d. Poll Diagnosis Results

Interval: 10 seconds, max 60 attempts:

aliyun sysom get-diagnosis-result \
  --task-id <task_id> \
  --user-agent AlibabaCloud-Agent-Skills

Check the status field in the response:

• Ready / Running → continue polling
• Success → diagnosis complete, proceed to Step 9
• Fail → diagnosis failed, inform the user

⛔ Behavioral Constraints During Polling (MUST OBEY):

>

During polling while waiting for diagnosis results, the following actions are STRICTLY FORBIDDEN (both executing and suggesting to the user):

1. FORBIDDEN to invoke Cloud Assistant to execute commands on the instance (e.g., top, vmstat, dmesg, iostat)

2. FORBIDDEN to call ECS monitoring, CloudMonitor, or other APIs

3. FORBIDDEN to attempt "alternative diagnosis methods" or initiate new diagnosis tasks

4. FORBIDDEN to call any command not listed in this skill's [Command Tables]

5. FORBIDDEN to suggest any of the above actions to the user as "alternatives" or "fallback options"

>

The ONLY permitted action: continue calling aliyun sysom get-diagnosis-result to poll, or stop after timeout.

>

Timeout handling: If still incomplete after 60 polling attempts, you MUST and can ONLY output the following template, then stop:

>

```

⏳ SysOM diagnosis task timed out

- Task ID: <task_id>

- Current status: <status>

- Suggestion: Please continue waiting for the diagnosis to complete.

```

>

FORBIDDEN to add any "alternative diagnosis method" suggestions in the timeout output. Actions that cannot be performed must not be suggested.

---

Step 9 — Result Parsing and Output

Key Field Interpretation

---

SysOM Diagnosis Capability Coverage

Enrollment and Alert Detailed Workflow

This document contains the detailed execution steps for SysOM instance enrollment and alert configuration (Steps 10–15).

All aliyun CLI commands MUST include --user-agent AlibabaCloud-Agent-Skills.

---

Enrollment Recommendation Phase (Inversion + Pipeline Pattern)

After diagnosis is complete, proactively recommend instance enrollment to the user. After enrollment, SysOM will continuously monitor instance health. When performance issues occur, it will automatically trigger diagnosis and push reports to DingTalk group bots, enabling 24/7 unattended intelligent operations.

Step 10 — Enrollment Recommendation and Intent Collection (Inversion Double Gate)

This step contains two strictly separated gates that MUST be executed in order — merging, skipping, or simplifying is FORBIDDEN.

Step 10A — Prominent Enrollment Recommendation (First Gate)

⚠️ Mandatory Rule: After presenting diagnosis results, you MUST immediately output the following recommendation content verbatim. Do NOT abbreviate, omit, or rephrase in your own words.

You must output the following complete content (replace <instance_id> with the actual instance ID):

---

## 🔔 Recommendation: Enroll Instance for 24/7 Automated Diagnosis

>

The diagnosis just performed was a one-time manual operation. If you want SysOM to continuously protect this instance, we recommend instance enrollment.

>

### After enrollment, you will get:

>

- 🔍 Automated Diagnosis: When the instance experiences performance issues like CPU spikes, memory leaks, or IO latency, SysOM will automatically trigger deep diagnosis without manual intervention

- 📲 DingTalk Alerts: Diagnosis reports will be automatically pushed to DingTalk group bots, notifying the ops team immediately

- 🛡️ Continuous Monitoring: 24/7 uninterrupted protection, shifting from "investigate after problems occur" to "automatically told the root cause when problems occur"

>

Would you like to enroll instance `<instance_id>`?

---

After outputting the above, STOP. Wait for user reply.

• User declines → end the pipeline
• User agrees → proceed to Step 10B

⚠️ Do NOT ask about enrollment method in Step 10A.

Step 10B — Ask Enrollment Method (Second Gate)

Only execute this step after the user explicitly agrees to enrollment in Step 10A.

You must output the following complete content (replace <instance_id> and <region> with actual values):

---

### Please choose an enrollment method

>

A. Enroll current instance only

Only enroll the instance just diagnosed: <instance_id> (<region>)

>

B. Enroll ACK cluster

If this instance belongs to an ACK cluster, you can enroll all nodes in the cluster with one click.

Newly added nodes will be automatically enrolled — no manual action needed.

👉 Please provide the ACK Cluster ID (e.g., c9d7f3fc3d42********c1100ffb19d)

>

C. Enroll multiple specified instances

Batch enroll multiple instances.

👉 Please provide the instance list in the format InstanceID:Region, separated by spaces

Example: i-xxx:cn-beijing i-yyy:cn-hangzhou

>

Please choose A / B / C, or tell me your requirements directly.

---

After outputting the above, STOP. Wait for user reply.

Intent Parsing Rules

---

Step 11 — Execute Enrollment

Enroll Single or Multiple Instances

aliyun sysom install-agent \
  --instances instance=<instance_id_1> region=<region_1> \
  --instances instance=<instance_id_2> region=<region_2> \
  --install-type InstallAndUpgrade \
  --agent-id 74a86327-3170-412c-8e67-da3389ec56a9 \
  --agent-version 3.12.0-1 \
  --user-agent AlibabaCloud-Agent-Skills

Enroll ACK Cluster

aliyun sysom install-agent-for-cluster \
  --cluster-id <cluster_id> \
  --agent-id 74a86327-3170-412c-8e67-da3389ec56a9 \
  --agent-version 3.12.0-1 \
  --config-id 8gj86wrt7-3170-412c-8e67-da3389ecg6a9 \
  --user-agent AlibabaCloud-Agent-Skills

install-type Enum Values

Note: For cluster enrollment, the initial enrollment installs the agent on all current ECS instances in the cluster (first batch limited to 50 if exceeding 50 instances). Newly added ECS instances will be automatically enrolled.

---

Step 12 — Enrollment Status Confirmation and Result Output

Instance Mode — Poll Instance Status (interval: 10s, max: 60 attempts)

aliyun sysom list-instance-status \
  --instance <instance_id> \
  --biz-region <region> \
  --user-agent AlibabaCloud-Agent-Skills

Cluster Mode — Poll Cluster Status

Get the full cluster list (do NOT pass `--cluster-id`), then match the target cluster by cluster_id field:

aliyun sysom list-clusters \
  --user-agent AlibabaCloud-Agent-Skills

From the returned cluster list, iterate through each cluster object, find the entry where cluster_id matches the target, and check its cluster_status field. Also record the name field for later use in create-alert-strategy.

Enrollment Status Reference

Result Display

• All successful → Inform user that all instances are enrolled, SysOM will continuously monitor
• Partially failed → List successful and failed instances, suggest checking failed ones
• All failed → Suggest checking network connectivity, RAM permissions, OS compatibility

---

Alert Configuration Phase (Pipeline Pattern)

After enrollment is complete, proceed directly to alert configuration: first create alert destination (collect Webhook), then select alert items, and finally create alert strategy.

Step 13 — Collect DingTalk Webhook and Create Alert Destination (Inversion Gate + SDK Call)

⚠️ Mandatory Rule: After successful enrollment, you MUST immediately collect the DingTalk bot Webhook URL from the user. Do NOT skip this step.

Alert destinations are used to push SysOM alerts to DingTalk group bots. This feature is NOT supported by CLI — use Python SDK scripts under scripts/.

⚠️ SDK Prerequisites

>

Before executing this step, run scripts/setup-sdk.sh to initialize the SDK environment (checks Python >= 3.8, creates virtual environment, installs SDK):

```bash

bash scripts/setup-sdk.sh

```

Step 13a — Collect Webhook URL from User

You must output the following complete content:

---

📲 Please provide the DingTalk group bot Webhook URL for receiving alert notifications.

Format: https://oapi.dingtalk.com/robot/send?access_token=xxx

>

💡 How to get it: DingTalk Group Settings → Bot Management → Add Bot → Custom Bot → Optional keyword: alert → Copy Webhook URL

---

After outputting the above, STOP. Wait for user reply.

Step 13b — Create Alert Destination

After the user provides the Webhook URL, immediately create the alert destination via script — no further confirmation needed:

.sysom-sdk-venv/bin/python scripts/create-alert-destination.py '<user-provided-webhook-url>'

Optionally specify a destination name:

.sysom-sdk-venv/bin/python scripts/create-alert-destination.py '<webhook-url>' '<destination-name>'

⚠️ You MUST use the virtual environment Python to execute scripts

>

FORBIDDEN to use python3 or python directly — system Python dependencies may be incompatible, causing signature verification failures.

On success, stdout outputs `destination_id` (a pure number), detailed info is output to stderr.

Result handling:

• Success → Display destination ID and name, inform user of successful creation, record destination_id for Step 15, immediately proceed to Step 14
• Failure → Display error message, suggest checking Webhook URL format and RAM permissions

---

Step 14 — Alert Item Selection (Inversion Gate)

⚠️ Mandatory Rule: After successful alert destination creation, you MUST immediately display the alert items list. Do NOT skip this step.

14a. Get Available Alert Items List

aliyun sysom list-alert-items --user-agent AlibabaCloud-Agent-Skills

14b. Display Alert Items List to User

Display the API-returned alert items categorized, each with a number. Format:

---

## 🔔 Please select alert items to enable

>

Enter numbers, separated by spaces:

>

Quick selection: all = select all | node-all = all NODE items | pod-all = all POD items

>

【NODE Saturation】

1. Node CPU Usage Detection

2. Node Kernel CPU Usage Detection

... (populate based on actual API response)

---

After outputting, STOP. Wait for user reply.

User Input Parsing Rules

---

Step 15 — Create Alert Strategy

After the user selects alert items, create the alert strategy directly with destinations set to the destination ID from Step 13.

15a. Determine clusters Parameter

15b. Execute Creation (SDK Call)

⚠️ CLI does NOT support the `destinations` parameter — you MUST use the SDK script to create alert strategies.

.sysom-sdk-venv/bin/python scripts/create-alert-strategy.py \
  --name "aliyun-aes-skills-create-<YYYYMMDDHHmm>" \
  --items "<alert_item_1>,<alert_item_2>" \
  --clusters "<clusters_value>" \
  --destinations "<destination_id>"

Parameter reference:

⚠️ You MUST use `.sysom-sdk-venv/bin/python` to execute scripts — using system python3 is FORBIDDEN.

On success, stdout outputs the strategy name, detailed info is output to stderr.

15c. Display Results

• Success → Display strategy name, alert item count, cluster, status, associated alert destinations; inform user that alerts will be pushed to DingTalk via SysOM
• Failure → Display error message, suggest checking RAM permissions, enrollment status, network connectivity

---

Alert Destination Management (On Demand)

Users can manage existing alert destinations via SDK as needed. The following operations all use the Python SDK — NOT supported by CLI.

Get Alert Destination Details

from alibabacloud_sysom20231230 import models

request = models.GetAlertDestinationRequest(id=<destination_id>)
response = client.get_alert_destination(request)

Update Alert Destination

Only fill in the fields that need to be modified:

from alibabacloud_sysom20231230 import models

request = models.UpdateAlertDestinationRequest(
    id='<destination_id>',
    name='<new_name>',                         # optional
    target='dingtalk',                         # optional
    params=models.UpdateAlertDestinationRequestParams(
        webhook='<new_webhook_url>'            # optional
    )
)
response = client.update_alert_destination(request)

Delete Alert Destination

from alibabacloud_sysom20231230 import models

request = models.DeleteAlertDestinationRequest(id=<destination_id>)
response = client.delete_alert_destination(request)

List All Alert Destinations

Filter by name parameter (optional); omit to return all:

from alibabacloud_sysom20231230 import models

request = models.ListAlertDestinationsRequest(name='<optional_filter_name>')
response = client.list_alert_destinations(request)

RAM Policies: alibabacloud-aes-sysom-os-diagnosis

This document lists all APIs and their corresponding RAM permissions used by the SysOM deep diagnosis skill.

---

SysOM Permissions

ECS Permissions

Minimum Permission Policy Example

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sysom:InitialSysom",
        "sysom:CheckInstanceSupport",
        "sysom:InvokeDiagnosis",
        "sysom:GetDiagnosisResult",
        "sysom:InstallAgent",
        "sysom:InstallAgentForCluster",
        "sysom:ListInstanceStatus",
        "sysom:ListClusters",
        "sysom:ListAlertItems",
        "sysom:CreateAlertStrategy",
        "sysom:CreateAlertDestination",
        "sysom:UpdateAlertDestination",
        "sysom:DeleteAlertDestination",
        "sysom:GetAlertDestination",
        "sysom:ListAlertDestinations"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeCloudAssistantStatus"
      ],
      "Resource": "*"
    }
  ]
}

Permission Tiers

Related Commands: alibabacloud-aes-sysom-os-diagnosis

This skill uses the aliyun CLI to call SysOM and ECS APIs. All commands MUST include --user-agent AlibabaCloud-Agent-Skills.

---

Diagnosis Phase

Enrollment Phase

Alert Phase

Alert Strategy Creation (SDK Call, NOT supported by CLI)

CLI does not support the destinations parameter — alert strategy creation must use the SDK script.

Alert Destination (SDK Call, NOT supported by CLI)

The following APIs are called via Python SDK (alibabacloud_sysom20231230), NOT supported by aliyun CLI.

Cleanup

Fixed Parameters

Success Verification: alibabacloud-aes-sysom-os-diagnosis

This document describes the success verification methods for each phase. All aliyun CLI commands MUST include --user-agent AlibabaCloud-Agent-Skills.

---

1. Environment Setup Verification

1.1 CLI Version

aliyun version --user-agent AlibabaCloud-Agent-Skills

Success criteria: Version >= 3.3.1

1.2 Credential Configuration

aliyun configure list --user-agent AlibabaCloud-Agent-Skills

Success criteria: Output contains a valid profile (AK, STS, or OAuth identity)

---

2. Diagnosis Phase Verification

2.1 Cloud Assistant Online Check

aliyun ecs describe-cloud-assistant-status \
  --biz-region-id <region> \
  --instance-id <instance_id> \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: CloudAssistantStatus is "true" in the response

2.2 SysOM Role Initialization

aliyun sysom initial-sysom --check-only false --source aes-skills --user-agent AlibabaCloud-Agent-Skills

Success criteria: No error returned

2.3 Instance Support Check

aliyun sysom check-instance-support \
  --instances <instance_id> \
  --biz-region <region> \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: Instance is marked as supported in the response

2.4 Diagnosis Execution

aliyun sysom invoke-diagnosis \
  --service-name ocd \
  --channel ecs \
  --params '{"instanceId":"<instance_id>","region":"<region>","enableDiagnosis":true,"startTime":0,"endTime":0,"aiRoadmap":true,"enableSysomLink":false}' \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: Response contains task_id

2.5 Diagnosis Result

aliyun sysom get-diagnosis-result \
  --task-id <task_id> \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: status is Success, response contains summary and issues data

---

3. Enrollment Phase Verification

3.1 Instance Enrollment

aliyun sysom install-agent \
  --instances instance=<instance_id> region=<region> \
  --install-type InstallAndUpgrade \
  --agent-id 74a86327-3170-412c-8e67-da3389ec56a9 \
  --agent-version 3.12.0-1 \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: No error returned

3.2 Instance Status Polling

aliyun sysom list-instance-status \
  --instance <instance_id> \
  --biz-region <region> \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: Instance status is running

3.3 Cluster Enrollment

aliyun sysom install-agent-for-cluster \
  --cluster-id <cluster_id> \
  --agent-id 74a86327-3170-412c-8e67-da3389ec56a9 \
  --agent-version 3.12.0-1 \
  --config-id 8gj86wrt7-3170-412c-8e67-da3389ecg6a9 \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: No error returned

3.4 Cluster Status Polling

aliyun sysom list-clusters \
  --cluster-id <cluster_id> \
  --user-agent AlibabaCloud-Agent-Skills

Success criteria: cluster_status is Running

---

4. Alert Phase Verification

4.1 SDK Environment Initialization

bash scripts/setup-sdk.sh

Success criteria: Output shows ✅ SDK installation successful, Python version >= 3.8

4.2 Alert Destination Creation (Script Call)

.sysom-sdk-venv/bin/python scripts/create-alert-destination.py 'https://oapi.dingtalk.com/robot/send?access_token=xxx'

Success criteria: stdout outputs destination_id (a pure number), stderr outputs ✅ Alert destination created successfully

4.3 Alert Strategy Creation (SDK Script Call)

.sysom-sdk-venv/bin/python scripts/create-alert-strategy.py \
  --name "aliyun-aes-skills-create-<YYYYMMDDHHmm>" \
  --items "<alert_items>" \
  --clusters "default" \
  --destinations "<destination_id>"

Success criteria: stdout outputs strategy name, stderr outputs ✅ Alert strategy created successfully