# Expected Diagnosis: O11Y-2233230

## Root Cause

Compound root cause: EBS IOPS throttling on 37 volumes (peak 38.9%) degraded TiKV write path, amplified by a high-frequency inefficient slow query (`SELECT * FROM dh_active_receive_logs`, 11,420 executions/30min, avg 1.53s latency). Commit time spiked 3-4x from baseline, causing P999 latency to exceed threshold.

## Evidence Chain

1. **EBS metrics**: 37 volumes with >20% throttling, peak 38.9% — infrastructure root cause
2. **DB Time Model**: Commit time 120→570 s/min (3-4x spike) — write path degradation signal
3. **Slow queries**: Top query `SELECT * FROM dh_active_receive_logs` — 11,420 exec, avg 1.53s, 56 fields returned — application-layer amplifier
4. **No cluster events**: No changes or scale operations during window

## Causality

High-frequency SELECT * queries → heavy Coprocessor read load → triggering EBS IOPS limit → TiKV write path also throttled → Commit latency 3-4x → P999 spike.

## Severity

Medium — auto-recovered; no data loss; similar pattern to O11Y-2190994.

## Recommendations

1. Create composite index on `dh_active_receive_logs(useridx, log_status, log_category, activetype, template, site_code)`
2. Replace `SELECT *` with explicit column list
3. Upgrade EBS volumes from gp2 to io2/gp3 with provisioned IOPS
4. Add EBS throttle alert at 5% threshold

## Scoring Rubric

> Checklist for regression testing. The Agent must satisfy these to pass.

- [ ] Identifies EBS IOPS throttling as a root cause contributor
- [ ] Identifies the slow query on `dh_active_receive_logs` (or similar table pattern)
- [ ] Reports Commit time spike as evidence of write path degradation
- [ ] Provides index creation recommendation for the slow query table
- [ ] Queries both metrics data and slow query data (not metrics alone)