Give Your ECS a 24/7 AI Doctor with STAROps Host Intelligent Inspection

At 3 am an alarm wakes you, and after hours of manually checking top, dmesg and iostat you discover a packet‑lossing NIC; the article shows that most incidents are chronic problems that surface only after they have built up, while conventional monitoring only alerts when metrics peak.

STAROps Host Intelligent Inspection (referred to as the “host intelligent inspection”) is described as “automatic health check + AI doctor”. It is a core capability of Alibaba Cloud’s STAROps platform, whose name reflects four principles: Sense, Target, Autonomy, Resilience, with the inspection serving the resilience pillar by shifting from reactive firefighting to proactive protection.

The service performs a “full‑body CT” of each ECS instance, covering CPU, memory, disk, network, GPU, kernel and hardware across more than 50 check items, and when an anomaly is found it not only reports the problem but also explains why it happened and suggests next steps.

STAROps acts as the orchestration layer and natural‑language front‑end, while the Alibaba Cloud Operating System console provides low‑level diagnostic operators such as memgraph and diskanalysis. When an issue is detected, STAROps invokes SysOM’s diagnostic tools to obtain kernel‑level conclusions and aggregates them into the inspection report.

The article highlights three hard‑won advantages:

Broad coverage: it probes beyond common CPU/memory/disk metrics into kernel events (soft‑lockup, hung‑task, RCU stall, conntrack saturation) and hardware signals (MCE errors, ECC errors, SMART alerts, NIC CRC errors).

Deep diagnosis: using the e‑commerce slowdown example, STAROps traces high iowait to a MySQL process repeatedly calling fsync, then identifies the root cause (sync_binlog=1) and offers an actionable fix.

Real‑world experience: all rules are derived from massive Alibaba Cloud customer incidents; each recommendation has been validated in production and is backed by fault‑injection test cases to guarantee 100 % detection accuracy.

Three concrete cases illustrate the value:

Before a major sales event, the inspection found kernel slab memory (SReclaimable) at 30 % of system memory, traced to a log‑collector agent’s massive dentry cache; adjusting the collection strategy freed 8 GB and avoided an OOM crash.

Intermittent microservice timeouts were linked to a conntrack table at 92 % utilization; increasing conntrack_max and enabling keep‑alive eliminated the timeouts.

A sudden DB latency spike (disk write latency from 5 ms to 200 ms) was diagnosed as IOPS contention from mixed O_SYNC writes; separating WAL and data disks restored latency to 5 ms.

Users can invoke the inspection in three modes, simply typing a natural‑language command such as “/host‑inspection on all ECS in the current workspace”. The article shows a five‑step workflow: user command → skill/parameter injection → exception event query → SysOM automatic diagnosis → graded inspection report, all illustrated with screenshots.

The AI doctor’s concrete outputs are demonstrated: a memory‑hotspot report that pinpoints a 2.72 GB shared‑memory leak across 30 × 32 MB files, and a disk‑diagnosis report that flags a 31.6 GB test‑fill file causing 91.7 % usage and recommends immediate deletion.

Finally, the article urges readers to enable Cloud Monitor 2.0, launch STAROps, and run a host inspection to catch risks before the next midnight alarm.