-- 1. CPU 高负载主机
SELECT tbname, hostname,
AVG(cpu_user + cpu_sys) AS cpu_pct
FROM host_metrics
WHERE ts > NOW - 5m
PARTITION BY tbname, hostname
HAVING cpu_pct > 80;
-- 2. 内存预警
SELECT hostname,
LAST(mem_used) * 100.0 / LAST(mem_total) AS mem_pct
FROM host_metrics
WHERE ts > NOW - 5m
PARTITION BY hostname
HAVING mem_pct > 90;
-- 3. 磁盘满预警
SELECT hostname,
LAST(disk_used) * 100.0 / (LAST(disk_used) + LAST(disk_free)) AS pct
FROM host_metrics
WHERE ts > NOW - 5m
PARTITION BY hostname
HAVING pct > 85;
-- 4. 应用错误突增
SELECT app_name,
SUM(error_count) AS errors
FROM app_metrics
WHERE ts > NOW - 5m
PARTITION BY app_name
HAVING errors > 100;
-- 5. 接口慢
SELECT service, endpoint,
AVG(latency_p99) AS p99
FROM http_metrics
WHERE ts > NOW - 5m
PARTITION BY service, endpoint
HAVING p99 > 1000;
-- 6. 5xx 错误率
SELECT service,
SUM(status_5xx) * 100.0 / SUM(request_count) AS err_rate
FROM http_metrics
WHERE ts > NOW - 5m
PARTITION BY service
HAVING err_rate > 1.0;
5. 服务大盘
sql复制代码
-- 1. 集群健康
SELECT cluster,
COUNT(DISTINCT hostname) AS hosts,
AVG(cpu_user + cpu_sys) AS avg_cpu,
AVG(mem_used * 100.0 / mem_total) AS avg_mem
FROM host_metrics
WHERE ts > NOW - 5m
PARTITION BY cluster;
-- 2. 服务依赖图基础数据
SELECT _wstart, service,
SUM(request_count) AS qps,
AVG(latency_p99) AS p99,
SUM(status_5xx) AS errors
FROM http_metrics
WHERE ts > NOW - 1h
PARTITION BY service
INTERVAL(1m);
-- 3. GC 频繁应用
SELECT app_name, instance_id,
SUM(gc_count) AS total_gc,
SUM(gc_time_ms) AS total_gc_ms
FROM app_metrics
WHERE ts > NOW - 1h
PARTITION BY app_name, instance_id
ORDER BY total_gc_ms DESC LIMIT 20;
6. 容量规划
sql复制代码
-- 1. 集群总资源
SELECT cluster,
SUM(LAST(mem_total)) / 1e9 AS total_mem_gb,
SUM(LAST(disk_used) + LAST(disk_free)) / 1e9 AS total_disk_gb
FROM host_metrics
PARTITION BY cluster;
-- 2. 历史增长趋势（用 TSMA 加速）
SELECT _wstart, cluster,
MAX(disk_used) / 1e9 AS disk_gb
FROM host_metrics
WHERE ts > NOW - 90d
PARTITION BY cluster
INTERVAL(1d);
-- 3. 增长率预测（线性外推）
WITH recent AS (
SELECT cluster,
LAST(disk_used) AS now_used,
FIRST(disk_used) AS month_ago
FROM host_metrics
WHERE ts > NOW - 30d
PARTITION BY cluster
)
SELECT
cluster,
now_used / 1e9 AS now_gb,
(now_used - month_ago) / 1e9 AS month_growth_gb,
(now_used + (now_used - month_ago) * 6) / 1e9 AS predicted_6mo
FROM recent;
7. 异常检测
sql复制代码
-- 1. 与历史基线比较
SELECT
_wstart, app_name,
AVG(qps) AS qps,
(SELECT AVG(qps) FROM app_metrics
WHERE app_name = a.app_name
AND ts BETWEEN _wstart - 7d AND _wstart - 7d + 1h) AS baseline
FROM app_metrics a
WHERE ts > NOW - 1h
PARTITION BY app_name
INTERVAL(5m)
HAVING qps < baseline * 0.5; -- 流量突降
-- 2. 标准差异常
SELECT
app_name, instance_id,
AVG(latency_p99) AS avg_lat,
STDDEV(latency_p99) AS std_lat
FROM app_metrics
WHERE ts > NOW - 1d
PARTITION BY app_name, instance_id
HAVING std_lat > avg_lat * 0.5;
8. 日志分析
sql复制代码
-- 1. 错误日志统计
SELECT app_name, COUNT(*) AS error_count
FROM app_logs
WHERE level >= 3 AND ts > NOW - 1h
PARTITION BY app_name
ORDER BY error_count DESC;
-- 2. 异常聚类（基于 exception 字段哈希）
SELECT
app_name, exception, COUNT(*) AS cnt
FROM app_logs
WHERE level >= 4 AND ts > NOW - 1d
GROUP BY app_name, exception
ORDER BY cnt DESC LIMIT 20;
-- 3. 关键字搜索（用 LIKE 或全文索引）
SELECT ts, app_name, instance_id, message
FROM app_logs
WHERE message LIKE '%Connection refused%'
AND ts > NOW - 1h;
-- 1. 高 CPU 告警流
CREATE STREAM stream_cpu_alert TRIGGER AT_ONCE INTO cpu_alerts AS
SELECT ts, hostname, cpu_user + cpu_sys AS cpu_pct
FROM host_metrics
WHERE cpu_user + cpu_sys > 90;
-- 2. 5 分钟错误率
CREATE STREAM stream_app_error INTO app_error_5m AS
SELECT _wstart, app_name, SUM(error_count) AS errors
FROM app_metrics
PARTITION BY app_name
INTERVAL(5m);
Grafana 模板
sql复制代码
-- Panel: 集群 CPU 热力图
SELECT
_wstart AS time,
hostname,
AVG(cpu_user + cpu_sys) AS value
FROM host_metrics
WHERE ts >= $from AND ts < $to
PARTITION BY hostname
INTERVAL($interval);
-- Panel: 服务 QPS 趋势
SELECT
_wstart AS time,
service,
SUM(request_count) AS value
FROM http_metrics
WHERE ts >= $from AND ts < $to
PARTITION BY service
INTERVAL($interval);
TDengine 专为物联网IoT平台、工业大数据平台设计。其中，TDengine TSDB 是一款高性能、分布式的时序数据库（Time Series Database），同时它还带有内建的缓存、流式计算、数据订阅等系统功能；TDengine IDMP 是一款AI原生工业数据管理平台，它通过树状层次结构建立数据目录，对数据进行标准化、情景化，并通过 AI 提供实时分析、可视化、事件管理与报警等功能。
