Observability Analysis¶

Obsy Copilot can combine the current page context with workspace data that the current user has access to, in order to summarize observable objects, analyze anomalies, and identify root causes. This page also covers the AI aggregation capability that is automatically performed by alert policies. Different capabilities have different data entry points and result formats, so you should navigate to the page or business workflow you want to analyze before using them.

Page Analysis & Root Cause Analysis¶

When you are viewing an anomalous record and want to quickly understand what happened, identify possible causes, or determine the next troubleshooting direction, you can open Obsy Copilot directly on the current page.

This capability currently covers the following page types:

• Alert events, Error Center, and incidents;
• Log and trace details;
• Dashboards;
• RUM sessions, pages, resources, actions, long tasks, and errors;
• Security signals;
• Hosts, containers, Kubernetes objects, processes, and database objects;
• Network overview, topology, network flows, network devices, and network paths;
• Database Query details; for SQL optimization rules, see Database Query Optimization.

The actual supported scope depends on whether the current page provides analysis context to Obsy Copilot.

Analyze the Current Page¶

1. Open the detail page you want to analyze and adjust the page time range to the period of interest.
2. Open Obsy Copilot, click the quick analysis prompt provided on the page, or directly describe your analysis goal.
3. If you have specific concerns, add the impact scope, related services, anomalous time period, or expected output you want to assess.

The following pages may display the corresponding quick analysis prompts:

The quick prompt disappears after you start entering other content, send a message, switch objects, or close the panel. The same object is only prompted once per panel session; after the prompt disappears, you can still enter the same goal directly.

Analysis Results¶

Obsy Copilot first reads the current object, then queries related evidence within the same time range as needed. For confirmed anomalies, the results typically include:

1. The current object and the anomalous phenomenon;
2. The most likely root cause or risk direction and its confidence level;
3. Log, metric, trace, or event evidence that supports the conclusion;
4. The known impact scope;
5. Actionable verification and handling recommendations.

If the current object has no clear anomaly, Obsy Copilot provides a summary and risk description instead of assuming a failure to produce a root cause analysis. When evidence is insufficient, the results point out the parts that have not been confirmed and the data that needs to be supplemented.

Detect Suspected App Blank Screen Issues¶

When analyzing App pages or sessions, Obsy Copilot combines data such as page loading, errors, and resource requests to help detect suspected blank screen issues and highlights the related clues in the analysis results. You do not need to first confirm that a blank screen occurred; you can also ask it to check whether there are cases where page content failed to render properly within the current scope.

1. In Real User Monitoring (RUM), select the target application and set the time range and filters of interest.
2. Enter the page or session explorer, open a specific record as needed, and then open Obsy Copilot.
3. Describe your analysis goal, for example, "Check the App access in the last 30 minutes, find pages with suspected blank screens, and explain the related clues and troubleshooting suggestions."

Once related clues are found, the results describe the involved pages or sessions, the evidence supporting the assessment, possible causes, and next-step inspection suggestions. If users have provided feedback, you can supplement the occurrence time, app version, device, and operation steps to help narrow down the scope.

Suspected blank screen notices need to be further confirmed against actual access behavior. Slow page loading, failed requests, or missing data alone cannot prove that a blank screen occurred; the analysis results are also not a statistical basis for an accurate blank screen rate.

Analyze Infrastructure Pages¶

On supported infrastructure pages, Obsy Copilot can combine the current object, time range, and filters to help you understand resource status and communication health. The currently supported pages include:

• Lists and details of hosts, containers, Kubernetes objects, and processes;
• Lists and details of database objects;
• Lists and details of Network overview, topology, network flows, network devices, and network paths.

To use it, first set the time range and filters on the page, then open Obsy Copilot and describe your analysis goal. For example, you can ask "Which hosts need priority attention right now", "Does this container have resource pressure", or "Where are the problems on this network path concentrated".

Within the data scope provided by the current page, Obsy Copilot organizes object status, resource usage, top distribution, or communication quality, and distinguishes confirmed facts, possible risk directions, and evidence that is still missing. When the page does not provide the necessary fields or there is no data in the current scope, the results state the limitation rather than directly judging missing data as healthy or abnormal resources.

The database object page is used to analyze the current status, capacity, and performance clues of an instance or resource. If you need to analyze why a particular SQL is slow or whether the execution plan is reasonable, go to the database Query detail page and refer to Database Query Optimization.

Analyze a Dashboard¶

When analyzing a dashboard, Obsy Copilot combines the current time range, filters, and chart content to organize the main trends, anomalous changes, and objects worth further inspection. Before starting the analysis, it is recommended to adjust the dashboard to the business scope of interest; if you only care about some charts, you can also state this directly in the question.

When the time range is large, the dashboard has many charts, or the queries are complex, the system prioritizes key charts or samples a portion of the data to complete the analysis and avoid long waits. The results state the actual scope analyzed this time, as well as content that was not fully covered due to sampling, query failures, timeouts, or permission limits. If you need a more complete item-by-item review, you can shorten the time range, reduce filter results, or specify the charts to prioritize, and then ask again.

Trend and anomaly judgments from dashboard analysis only apply to the analysis scope stated in the results. For important business decisions or production handling, you should still return to the original charts to verify key data.

List & Asset Analysis¶

When a single record is not enough to describe the overall situation, or you need to find anomaly distributions, top objects, and common characteristics from the current list, you can ask Obsy Copilot to analyze the current list.

This capability applies to dashboards, logs, traces, RUM, alert events, security signals, Error Center, incidents, and supported infrastructure list pages. The specific fields and objects that can be analyzed depend on the filters and data scope provided by the current page.

Analyze the Current List¶

1. On the list page, set the time range and filters so the list stays within the business scope you want to analyze.
2. Open Obsy Copilot and describe the conclusions you want, for example, "Summarize the anomaly distribution of the current list", "Find the service with the most errors", or "Analyze the common characteristics of recent events".
3. If you need comparison or sorting, specify the grouping dimension, metrics of interest, or top N count.

Obsy Copilot follows the query boundary of the current page and prioritizes aggregation or sampling a small number of records rather than reading all details without bounds.

If sampling is used, the results state the actual data scope covered. If you need to examine all objects, you can narrow the time range or filter scope and analyze again.

Analysis Results¶

The results typically include an overview of the current scope, key counts, top distribution, representative samples, risk descriptions, and next-step recommendations. When the list does not have enough fields, the query fails, or the results are empty, Obsy Copilot preserves the current facts and states the evidence gaps.

List analysis does not change the current filters, nor does it perform batch operations on list objects.

Database Query Optimization¶

When the database Query detail page shows excessively long query times, excessive scan volumes, or abnormal execution performance, you can use this capability to analyze the SQL and the execution plan.

Run an Optimization Analysis¶

1. Open the Query detail page of the target database.
2. Open Obsy Copilot and enter "Analyze the current SQL", "Why is this Query slow", or "Provide optimization recommendations based on the execution plan".
3. If you have a clear objective, such as reducing scanned rows, improving index usage, or reducing sorting overhead, you can state it together with the question.

Analysis Results¶

Obsy Copilot analyzes based on the data already available in the current Query details. The results may include:

• Available statistics such as database type, query duration, number of calls, scanned rows, and returned rows;
• The original SQL;
• The returned execution plan and key fields;
• Recommendations for query rewriting, indexing, filter conditions, or execution methods.

If the current details do not return an execution plan, Obsy Copilot shows the available SQL and states the missing evidence without fabricating execution nodes or costs. This capability only provides analysis and recommendations. It does not automatically execute the rewritten SQL, nor does it modify database objects.

Alert Aggregation & Compression¶

When a large number of duplicate or related alerts are generated in the same period and reading them one by one makes it difficult to identify the main problem, you can enable AI aggregation in the alert policy. The system classifies, deduplicates, and summarizes the alerts within the configured aggregation period, and then sends an aggregated notification according to the alert policy. This capability runs automatically through the alert policy; you do not need to open Obsy Copilot or start a conversation.

This capability focuses on identifying:

• Alerts repeatedly triggered by the same monitor;
• Related alerts generated by the same host, application, service, or dependency;
• Common categories such as cloud platforms, infrastructure, Kubernetes, middleware, databases, logs, traces, and delivery pipelines;
• High-frequency objects and anomalies that require priority attention.

Aggregation Results¶

The system generates structured results based on the aggregation time range and the input alert set, including:

• The number of monitors that triggered alerts and the number of alert notifications during the aggregation period;
• Monitors organized by anomaly type, representative titles, and category summaries;
• Correlation descriptions for high-frequency hosts, applications, or services;
• Recommendations for duplicate alerts, related anomalies, and priority troubleshooting targets.

Events with a status of Recovered can be used to explain that an issue has recovered, but they are not counted in the anomalous alert count and are not used as the primary basis for root cause recommendations. Aggregation results are based only on the alert content passed in this time and cannot replace further verification of the original metrics, logs, and traces.

Incident Preliminary Analysis¶

When generating an incident from the Incident Center, you can use Obsy Copilot to generate a structured initial assessment based on the event details already passed in, helping responders quickly understand the problem background and begin troubleshooting.

Preliminary Analysis Results¶

When this capability is enabled in the current workflow, Obsy Copilot extracts available information from the event details and organizes the following content based on the actual data:

• Event title, status or severity, and first occurrence time;
• Detection time range, affected objects, and key metric snapshots;
• Possible causes ordered by priority;
• Recommendations for urgent troubleshooting, change rollback, and process escalation.

The preliminary analysis only uses the event details passed into the current incident workflow. When time, severity, impact scope, or metrics are missing, the corresponding content is omitted and uncertainty is clearly stated; no data is fabricated.