Huawei Cloud CCE Log Analyzer

Overview

Use this skill for read-only log queries and analysis, or for confirmed management of CCE LogConfig and LTS Access Config collection rules. It does not modify workloads, log groups, log streams, LTS log data, or unrelated cloud resources.

Prerequisites

• Python 3.8+, hcloud (≥ 7.2.2), and credentials with the required CCE and LTS permissions.
• Pod stdout and CCE LogConfig tools require kubectl with the kubectl cce plugin for cluster access.
• kubectl cce dependency: The kubectl cce plugin provides CCE cluster access. Install it through the dedicated kubectl-cce installer skill. Follow the plugin usage contract.
• The Cloud Native Logging add-on is required for CCE LogConfig tools. LTS AGENT collection requires a healthy iCagent.
• Audit, kube-apiserver, and kube-scheduler tools require their matching CCE Log Center switch. The tools check the switch through CCE ShowClusterConfig and never enable it.
• Explicit --cli-access-key, --cli-secret-key, and optional --cli-security-token use only the supplied credentials. AK/SK must be supplied together, and a token requires that pair. They are forwarded to hcloud and kubectl cce; profile and credential environment-variable fallback are disabled. --cli-project-id or project_id can provide the target project when required. Without explicit CLI credentials, the order is ak/sk/project_id, local hcloud profile, then HW_ACCESS_KEY, HW_SECRET_KEY, and HW_PROJECT_ID.
• LTS start_time and end_time use UTC YYYY-MM-DD HH:MM:SS. If omitted, the tools generate a recent UTC window.

Environment Variables

Region Selection

• Use region=<region> from the current user request or established task context when it is available.
• If no region parameter is supplied, use HW_REGION_NAME.
• If neither source provides a region, return an error asking the user to provide region or set HW_REGION_NAME. Do not infer a target region from an hcloud profile or any other environment variable.

Core Commands And Tool Routing

Use python3 scripts/huawei-cloud.py help to print the available actions and required parameters. Full invocation and parameter details are in references/tool-reference.md.

Parameters And Collection Scope

Input Parameter Validation

Required parameters must be provided before execution. A required cluster_id, or an optional cluster_id supplied by the user, must pass the following validation before any cluster-targeted request. Query tools may query the region globally only when their optional cluster_id is omitted:

1. Check whether cluster_id is a standard UUID:
   • UUID: call hcloud CCE ShowCluster to verify it.
   • Otherwise: call hcloud CCE ListClusters, perform an exact and unique name match, convert it to a UUID, then call ShowCluster to verify it. If a required cluster_id is missing, or any supplied cluster_id is invalid, unmatched, or ambiguous, stop the operation and require the user to provide the correct region and cluster ID. A supplied invalid cluster_id must never fall back to a global query; never guess or select a cluster. For any other required resource identifier, first use the corresponding read-only query tool to list candidates when the user cannot provide an unambiguous value, then ask the user to choose; never select a candidate automatically.

Input Parameters

Tool Parameters

Collection Scope

Use the parameter that controls the collection source, not the namespace where a LogConfig object is stored.

For huawei_get_pod_stdout_logs and huawei_analyze_pod_stdout_realtime_logs, both pod_name and namespace are required. Do not infer the namespace or fall back to default.

logconfig_namespace is only the Kubernetes namespace that stores the LogConfig custom resource, normally kube-system; it does not limit which application logs are collected. Review the previewed request_body before confirmation.

namespaces Input

Use namespaces only with source_type=container_stdout all_containers=true to limit collection to one or more application namespaces. It is not the LogConfig storage namespace and is not the single-workload namespace selector.

Quote JSON arrays so the shell passes them unchanged. Each value must be a valid Kubernetes namespace name. [default] is not a valid input format.

Operating Workflow

1. Identify the source

• A named Pod: use huawei_get_pod_stdout_logs first.
• A named application: provide namespace and app_name; query LTS first through huawei_query_application_logs. A unique collection rule is discovered automatically, while multiple matches are presented for the user to choose. Only when no usable collection rule exists may the workflow use huawei_get_pod_stdout_logs; require the user to provide the Pod name and do not select one automatically.
• Who changed or deleted a resource: use audit logs first. Audit evidence contains actor information; kube-apiserver logs are supplemental HTTP evidence only.
• API availability or latency: use kube-apiserver analysis. Read non_success_status_count for failed HTTP requests and non_watch_latency for ordinary API latency.
• Pending or unschedulable workloads: use kube-scheduler analysis. Repeated scheduling/preemption messages are retries, not separate Pods.

2. Query narrowly, then expand

Start with hours=1, a specific namespace, Pod, or selected collection rule. Use auto_paginate=true, limit, and max_pages only when the initial result is insufficient. Do not apply keywords before an application-log abnormal-ratio analysis unless the user explicitly requests keyword-scoped analysis.

For application logs from a shared LTS stream, inspect filter_quality before attributing findings: exact means indexed clusterId, nameSpace, and appName labels were applied; partial or unscoped means returned logs can include other applications, so all statistics apply only to the returned set.

Application queries default to output=summary; use output=samples for a bounded sample or output=raw only when full log entries are required. The tool checks indexed aliases including clusterId/cluster_id/k8s.cluster.id, nameSpace/namespace/k8s.namespace.name, and appName/app.kubernetes.io/name/app before it sends label filters to LTS. It also validates app_name against current Deployment, StatefulSet, DaemonSet, Job, and CronJob resources in the specified namespace. An unmatched result is a warning, not a query failure, because historical logs can outlive workloads.

When an application query returns no logs, the result includes a prompt to verify namespace and app_name. If current workload validation is also unmatched, the prompt explicitly calls out that the supplied application name may be incorrect.

3. Interpret before acting

• A missing audit event does not disprove an operation; it may be outside retention or absent from audit delivery. Search kube-apiserver logs for the request when that switch is enabled, but do not infer the actor from its user agent alone.
• kube-apiserver WATCH duration is connection lifetime, not normal request-processing latency. Use summary.non_watch_latency for performance conclusions.
• kube-scheduler preemption_issue can accompany a scheduling failure caused by hard constraints such as PV node affinity or pod anti-affinity. Inspect the affected Pod and constraints before recommending capacity changes.
• Redact secrets, tokens, authorization headers, cookies, and personal data in all summaries.

4. Mutate only after confirmation

For R2 and R1 tools, discover the destination or exact target, call the tool without confirm=true, show the preview, and wait for explicit user confirmation before calling again with confirm=true. The skill never creates or selects an LTS log group or stream automatically; the user must provide the selected destination IDs.

Parameter Confirmation

Confirmation Flow

Call without confirm=true → Preview output → User reviews → User confirms → Call with confirm=true

• Do not skip preview for any LogConfig or LTS Access Config operation
• Do not call with confirm=true without showing the preview first
• Do not assume the preview is correct without user verification

KooCLI Command Format Standard

hcloud <Service> <Operation> --cli-region=<region> [--key=value ...]

Verified CLI Commands

References

Quality Reporting

This Skill integrates skill_quality_sdk.py for execution quality reporting. Every run automatically reports trace_id, status (success/biz_fail/sys_fail/cancel), error code, cost, and masked input/output to the operations console.

Integration

• Python entry point: wrap main logic with quality_context context manager:

  from skill_quality_sdk import quality_context, QualityError
  
  with quality_context(skill_name="huawei-cloud-cce-log-analyzer", skill_version="1.0.0") as q:
      q.input = {...}
      result = do_something()
      q.output = result
  

• CLI-only Skill: the SDK is vendored in scripts/ for future Python wrapper use.

Error Code Convention

Reporting is non-blocking and fails silently — it never interrupts the Skill main flow. Disable via SKILL_QUALITY_DISABLE=1 for local testing.

Output Format

See output-schema.md for the response shape. Summaries include the target, time window, source, findings, and any query limits.

Verification

Confirm the returned source, time window, and collection-rule or Pod target match the requested scope before interpreting results.

Best Practices

Start with a narrow namespace, Pod, time window, or application identity. For application logs, a unique discovered collection rule is used automatically; multiple matching rules are presented for the user to choose.

Notes

Missing data can indicate unavailable collection, retention expiry, or an unmatched source rule; it does not prove that the workload is healthy.