{
    "direct_cause": {
        "summary": "Severe write hotspot on TiKV-3 causing massive write I/O spikes, CPU overload, and transaction latency degradation",
        "evidences": [
            {
                "source_type": "metrics",
                "description": "TiKV-3 experiencing 66% CPU usage with 112.7x cross-sectional outlier anomaly, indicating extreme write hotspot concentration",
                "metric_name": "tikv_cpu_usage"
            },
            {
                "source_type": "metrics",
                "description": "TiKV-3 write I/O bytes spiked to 68.8GB with 25.4x cross-sectional outlier, far exceeding peer instances (7.4GB median)",
                "metric_name": "tikv_write_io_bytes"
            },
            {
                "source_type": "metrics",
                "description": "TiKV-3 kv_prewrite latency degraded to 102ms (29,657x temporal baseline anomaly) and 105.5x cross-sectional outlier",
                "metric_name": "tikv_grpc_message_duration_p99"
            },
            {
                "source_type": "top_cpu_time_sqls",
                "description": "Batch insert operations consuming 1.76 CPU-seconds on TiKV-3, creating write concentration pattern",
                "sql": {
                    "sql_digest": "97c5adef9c746ad0dfd3b997dd2e97b0a769659bd2d63c70545a8bd4edb23249",
                    "full_sql_text": "insert into `c66_capital` . `t_product_tran_20251226` ( `id` , `product_id` , `tran_source` , `flag` , ... ) values ( ... )"
                }
            },
            {
                "source_type": "metrics",
                "description": "Insert latency degraded from 7.98ms to 250ms baseline (40,635x temporal anomaly), indicating severe write bottleneck",
                "metric_name": "tidb_duration_p99"
            }
        ],
        "jira_issue_related_metrics_name": "tikv_cpu_usage"
    },
    "detail": {
        "cluster_topology": "2-tidb-16C32G / 6-tikv-16C64G-IO2 (io2, IOPS: 8000) / 3-pd-8C16G / 2-tiflash-16C128G (gp3, IOPS: 16000)",
        "workload": [
            {
                "name": "tidb_qps",
                "status": "WARNING",
                "current_value_summary": "Insert QPS increased from 125 to 194 (+55%) with sharp rising pattern at 05:51",
                "temporal": {
                    "trend_type": "RISING",
                    "change_point": "05:51:00",
                    "baseline_deviation": "8.69x temporal baseline anomaly (z-score: 8.69)",
                    "description": "Insert operations showing sustained elevation with moderate intensity rising trend"
                },
                "capacity": {
                    "status": "NORMAL"
                },
                "detected_signals": [
                    "Insert QPS temporal baseline anomaly",
                    "Moderate rising trend in insert workload"
                ]
            },
            {
                "name": "tidb_affected_rows",
                "status": "CRITICAL",
                "current_value_summary": "Affected rows spiked dramatically from 478 to 8,181 (+1,612%) indicating massive bulk operations",
                "temporal": {
                    "trend_type": "SPIKE",
                    "change_point": "05:49:00",
                    "baseline_deviation": "298.5x temporal baseline anomaly (z-score: 298.54)",
                    "description": "Extreme spike in affected rows indicating large batch insert operations"
                },
                "capacity": {
                    "status": "CRITICAL",
                    "limit_info": "Batch size far exceeds normal operational patterns"
                },
                "detected_signals": [
                    "Extreme temporal baseline anomaly in affected rows",
                    "Large batch operation pattern"
                ]
            },
            {
                "name": "tikv_grpc_message_count",
                "status": "CRITICAL",
                "current_value_summary": "TiKV-3 kv_prewrite messages increased to 2,583/sec (80.2x baseline anomaly)",
                "spatial": {
                    "is_imbalanced": true,
                    "outlier_instances": [
                        "db-tikv-3"
                    ],
                    "description": "TiKV-3 handling 169.1x more prewrite operations than peer instances, indicating severe write hotspot"
                },
                "temporal": {
                    "trend_type": "SPIKE",
                    "change_point": "05:51:00",
                    "baseline_deviation": "80.2x temporal baseline anomaly",
                    "description": "Massive increase in prewrite operations concentrated on single TiKV instance"
                },
                "capacity": {
                    "status": "CRITICAL",
                    "limit_info": "Single instance handling disproportionate write load"
                },
                "detected_signals": [
                    "Cross-sectional outlier",
                    "Temporal baseline anomaly",
                    "Write hotspot concentration"
                ]
            }
        ],
        "resource": [
            {
                "name": "tikv_cpu_usage",
                "status": "CRITICAL",
                "current_value_summary": "TiKV-3 CPU at 66% usage, TiKV-1 at 34%, TiKV-5 at 30% - severe imbalance",
                "spatial": {
                    "is_imbalanced": true,
                    "outlier_instances": [
                        "db-tikv-3",
                        "db-tikv-1",
                        "db-tikv-5"
                    ],
                    "description": "TiKV-3 showing 112.7x cross-sectional outlier with extreme CPU concentration"
                },
                "temporal": {
                    "trend_type": "SPIKE",
                    "change_point": "05:51:00",
                    "baseline_deviation": "17.5x temporal baseline anomaly for TiKV-3",
                    "description": "Extreme CPU spike on TiKV-3 correlating with write hotspot onset"
                },
                "capacity": {
                    "status": "CRITICAL",
                    "limit_info": "TiKV-3 approaching CPU saturation with uneven load distribution"
                },
                "detected_signals": [
                    "Cross-sectional outlier",
                    "Temporal baseline anomaly",
                    "Resource imbalance"
                ]
            },
            {
                "name": "tikv_write_io_bytes",
                "status": "CRITICAL",
                "current_value_summary": "TiKV-3 write I/O at 68.8GB, peers at 7.4GB median - 9.3x imbalance",
                "spatial": {
                    "is_imbalanced": true,
                    "outlier_instances": [
                        "db-tikv-1",
                        "db-tikv-3",
                        "db-tikv-5"
                    ],
                    "description": "TiKV-3 handling 25.4x more write I/O than peer instances"
                },
                "temporal": {
                    "trend_type": "SPIKE",
                    "change_point": "05:51:00",
                    "baseline_deviation": "89.99x temporal baseline anomaly for TiKV-3",
                    "description": "Massive write I/O spike on TiKV-3 indicating concentrated write operations"
                },
                "capacity": {
                    "status": "CRITICAL",
                    "limit_info": "Write I/O severely concentrated on single TiKV instance"
                },
                "detected_signals": [
                    "Cross-sectional outlier",
                    "Temporal baseline anomaly",
                    "Write I/O concentration"
                ]
            },
            {
                "name": "tikv_disk_read_iops",
                "status": "WARNING",
                "current_value_summary": "TiKV-3 read IOPS at 1,126 with 12.8x temporal baseline anomaly",
                "spatial": {
                    "is_imbalanced": true,
                    "outlier_instances": [
                        "db-tikv-3"
                    ],
                    "description": "TiKV-3 showing 5.7x higher read IOPS than peer instances"
                },
                "temporal": {
                    "trend_type": "RISING",
                    "change_point": "05:51:00",
                    "baseline_deviation": "12.8x temporal baseline anomaly",
                    "description": "Elevated read IOPS on TiKV-3 likely due to compaction from heavy writes"
                },
                "capacity": {
                    "status": "NORMAL"
                },
                "detected_signals": [
                    "Temporal baseline anomaly",
                    "Cross-sectional outlier"
                ]
            }
        ],
        "latency": [
            {
                "name": "tidb_duration_p99",
                "status": "CRITICAL",
                "current_value_summary": "Insert latency degraded to 250ms (40,635x baseline anomaly), Commit latency to 117ms",
                "temporal": {
                    "trend_type": "SPIKE",
                    "change_point": "05:49:00",
                    "baseline_deviation": "40,635x temporal baseline anomaly for Insert operations",
                    "description": "Catastrophic latency degradation for write operations starting at 05:49"
                },
                "capacity": {
                    "status": "CRITICAL",
                    "limit_info": "Write latencies far exceed acceptable thresholds"
                },
                "detected_signals": [
                    "Extreme temporal baseline anomaly",
                    "Sharp latency degradation",
                    "Write operation bottleneck"
                ]
            },
            {
                "name": "tikv_grpc_message_duration_p99",
                "status": "CRITICAL",
                "current_value_summary": "TiKV-3 kv_prewrite latency at 102ms (29,657x baseline anomaly), 105.5x cross-sectional outlier",
                "spatial": {
                    "is_imbalanced": true,
                    "outlier_instances": [
                        "db-tikv-1",
                        "db-tikv-3",
                        "db-tikv-5"
                    ],
                    "description": "TiKV-3 showing extreme prewrite latency compared to peer instances"
                },
                "temporal": {
                    "trend_type": "SPIKE",
                    "change_point": "05:51:00",
                    "baseline_deviation": "29,657x temporal baseline anomaly for TiKV-3 prewrite",
                    "description": "Catastrophic prewrite latency spike on TiKV-3"
                },
                "capacity": {
                    "status": "CRITICAL",
                    "limit_info": "Prewrite operations severely degraded on hotspot instance"
                },
                "detected_signals": [
                    "Extreme temporal baseline anomaly",
                    "Cross-sectional outlier",
                    "gRPC message latency spike"
                ]
            },
            {
                "name": "tikv_write_pipeline_duration",
                "status": "CRITICAL",
                "current_value_summary": "TiKV-3 apply_wait at 33.7ms (10,642x baseline anomaly), apply_duration at 13ms",
                "spatial": {
                    "is_imbalanced": true,
                    "outlier_instances": [
                        "db-tikv-1",
                        "db-tikv-3",
                        "db-tikv-5"
                    ],
                    "description": "TiKV-3 showing extreme apply wait times indicating Raft log application bottleneck"
                },
                "temporal": {
                    "trend_type": "SPIKE",
                    "change_point": "05:51:00",
                    "baseline_deviation": "10,642x temporal baseline anomaly for apply_wait",
                    "description": "Severe Raft log application delays on TiKV-3"
                },
                "capacity": {
                    "status": "CRITICAL",
                    "limit_info": "Raft consensus severely impacted by write concentration"
                },
                "detected_signals": [
                    "Extreme temporal baseline anomaly",
                    "Cross-sectional outlier",
                    "Raft application bottleneck"
                ]
            }
        ],
        "events": [
            "BackupCluster tasks completed successfully during timeframe (succeeded at 2025-12-25T18:00:13)",
            "No topology changes or maintenance events during analysis window",
            "PD scheduling activity increased with balance-leader and balance-region operations starting at 05:51",
            "DDL operations detected: table creation and auto_random_base adjustments"
        ]
    },
    "metadata": {
        "analysis_uuid": "8b47ea35-ba96-478f-ac97-e3d494779343",
        "jira_issue_id": "O11Y-1956041",
        "cluster_id": "10355969091959802668",
        "time_range_start_ts": 1766726940,
        "time_range_end_ts": 1766728740,
        "created_at": "2025-01-20T20:22:47+00:00"
    }
}