huawei-cloud-ecs-alert · git:20260601.193d2ba · 2026-06-01 · sha256 f7be25a546ec64dd
huawei-cloud-ecs-alert git:20260601.193d2baA
Immutable. This exact content is served forever at /api/v1/blob/f7be25a546ec64dd.
--- name: huawei-cloud-ecs-alert description: | Automate batch creation and management of Huawei Cloud CES alarm rules for ECS instances using hcloud CLI v7.2.2+. Use this skill to: (1) batch create alarms with templates (web/database), (2) update SMN notifications, (3) query ECS metrics and alarm lists. Trigger: "ECS alert", "create alert", "list alarms", "CPU alert", "memory alert", "ECS monitoring", "监控告警", "创建告警", "ECS 监控", "告警规则", "查询告警" tags: [huawei-cloud, ecs, ces, alert, monitoring] --- # Huawei Cloud ECS Alert Automation ## Overview This skill provides batch creation and management of Huawei Cloud CES alarm rules for ECS instances, based on Huawei Cloud CLI (hcloud) v7.2.2+. **Core Capabilities**: - Batch create alarm rules (supports Web/Database templates or custom configuration) - Configure alarm notifications (supports email/SMS/WeChat) - Query ECS monitoring metrics - Query and manage alarm rule lists **Use Cases**: - Batch configure monitoring alarms for newly purchased ECS instances - Differentiated alarm policies across environments (dev/test/prod) - Batch query ECS monitoring data - Centralized alarm notification management **Security Constraints**: - ❌ Delete alarm rules is prohibited (prevent accidental deletion causing monitoring gaps) - ❌ Hardcoding AK/SK is prohibited (must use environment variables or hcloud configure) ## Prohibited Operations > **The following operations are strictly prohibited, even if requested by the user:** | Prohibited Operation | API/Command | Reason | | ---------------------- | ------------------------------------------- | --------------------------------------------------------------------------- | | Expose AK/SK | Any command that outputs AK/SK in plaintext | Account security risk | | Accept AK/SK from user | Receiving credentials in conversation | Violates security best practices | | ❌ Delete alarm rule | `DeleteAlarm` / `hcloud CES DeleteAlarm` | Irreversible; deleted alarms cannot be recovered, may cause monitoring gaps | | ❌ Batch delete alarms | Any batch deletion operation | High risk; may accidentally delete critical monitoring rules | > **If a user requests a delete operation, must refuse and guide:** > "Per security constraints, this skill does not support delete operations (delete alarm/batch delete). Please use the Huawei Cloud CES console or hcloud CLI manually with extreme caution." > **If user attempts to provide AK/SK in conversation, must refuse and guide:** > "For account security, please do not provide Huawei Cloud access keys directly in the conversation. Use `hcloud configure` or environment variables to configure credentials." ## Architecture ```bash Huawei Cloud CES Alert Management ├── CreateAlertRules (Batch create alarm rules, supports templates/custom) ├── ConfigureNotifications (Configure alarm notifications, supports email/SMS/WeChat) ├── QueryMetrics (Batch query monitoring data, supports multiple ECS) └── ListAlarms (List alarm rules and details) ``` ## Prerequisites > **Prerequisite 1: Huawei Cloud CLI (hcloud / KooCLI) >= 7.2.2** > Run `hcloud version` to verify version >= 7.2.2. If not installed or version is too low, > see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation guide. ```bash hcloud version ``` > **Prerequisite 2: Huawei Cloud Credentials Configured** > Check if CLI configuration contains valid credentials (AK/SK, IAM, etc.). > > ```bash > hcloud configure list > > ``` > > > **Credential Configuration Methods (choose one):** > > > > 1. **hcloud CLI configuration (recommended)**: `hcloud configure` interactive setup, credentials encrypted and stored > > 2. **Environment variables**: Set `HUAWEI_CLOUD_ACCESS_KEY_ID` and `HUAWEI_CLOUD_SECRET_KEY` before running scripts > > 3. **Environment variables (legacy)**: Set `HW_ACCESS_KEY_ID` and `HW_SECRET_ACCESS_KEY` > > > > **Note**: Shell scripts (`create_alert_rules.sh`, `list_ecs.sh`, etc.) automatically use credentials from hcloud CLI configuration. > > Python SDK scripts (`create_email_subscription.sh`) support environment variables. > **If output does not contain valid configuration, stop operation and guide user to configure.** > **hcloud Parameter Format Requirement** > hcloud (KooCLI) **all parameters must use `--param=value` format** (equals sign connection), does not support space > separation. > ✅ Correct: `hcloud CES ListAlarms --region=cn-north-4` > ❌ Incorrect: `hcloud CES ListAlarms --region cn-north-4` > > This skill provides 8 Shell scripts, encapsulating common hcloud commands, supporting batch operations and formatted > output. > > <details> > <summary>**Script List and Usage Examples (Click to Expand)**</summary> > > | Script | Function | hcloud Command | > | ------------------------------- | --------------------------------------- | ------------------------------------- | > | `list_ecs.sh` | Query ECS instance list | `hcloud ECS ListServersDetails` | > | `list_alarms.sh` | Query alarm rule list | `hcloud CES ListAlarms` | > | `create_alert_rules.sh` | Batch create alarm rules | `hcloud CES CreateAlarm` | > | `batch_query_metrics.sh` | Batch query monitoring data | `hcloud CES ShowMetricData` | > | `list_subscriptions.sh` | Query SMN topics and subscriptions | `hcloud SMN ListTopics/Subscriptions` | > | `manage_notifications.sh` | Manage SMN subscriptions | `hcloud SMN Subscribe/Unsubscribe` | > | `update_alarm_notifications.sh` | Update alarm notification configuration | `hcloud CES UpdateAlarm` | > > **Usage Examples:** > > ```bash > > # Query ECS instances > > ./scripts/list_ecs.sh # Query all ECS > ./scripts/list_ecs.sh --name ecs-001 # Filter by name > ./scripts/list_ecs.sh --output json # Output as JSON > ./scripts/list_ecs.sh --output ids # Output only ECS ID list > > # Query alarm rules > > ./scripts/list_alarms.sh # Query all alarms > ./scripts/list_alarms.sh --name-pattern "cpu.*" # Filter by name pattern > ./scripts/list_alarms.sh --output ids # Output only alarm IDs > > # Create alarm rules > > ./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001,ecs-002 > ./scripts/create_alert_rules.sh --metric cpu_util --threshold 80 --ecs-ids ecs-001 > ./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001 --smn-topic-urn > urn:smn:cn-north-4:xxx:ECS_ALARM_NOTIFY > ./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001 --dry-run # Dry run > > ```bash > > </details> ## Core Capabilities - **Batch Create Alarm Rules**: Support template-based creation (Web/Database scenarios) or custom metric/threshold configuration - **Batch Query Monitoring Data**: Support multi-ECS concurrent query, output CPU/Memory/Disk metrics - **Notification Configuration**: Support email/SMS/WeChat notification, SMN subscription management - **Security Compliance**: AK/SK via environment variables or CLI config, never hardcode ## Usage Scenarios ### Scenario 1: Batch Configure Alarms for New ECS **Background**: Purchased 10 new ECS instances, need to configure CPU/Memory alarm rules for all. **Steps**: 1. Query ECS instance IDs 2. Batch create alarm rules using web template 3. Configure email notification ```bash # 1. Query ECS instances export HUAWEI_CLOUD_AK=<AK> && export HUAWEI_CLOUD_SK=<SK> && export HUAWEI_CLOUD_REGION=cn-north-4 ./scripts/list_ecs.sh --output ids # 2. Batch create alarm rules ./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001,ecs-002,ecs-003 # 3. Configure notification ./scripts/manage_notifications.sh --action subscribe --topic-urn <SMN_TOPIC_URN> --protocol email --endpoint user@example.com ``` ### Scenario 2: Query Monitoring Data for Multiple ECS **Background**: Need to check CPU utilization for 5 ECS instances over the past hour. ```bash ./scripts/batch_query_metrics.sh \ --ecs-ids ecs-001,ecs-002,ecs-003,ecs-004,ecs-005 \ --metric cpu_util \ --from 2024-01-01T10:00:00Z \ --to 2024-01-01T11:00:00Z \ --output table ``` ## Input Parameters - **AK/SK**: Via environment variables `HUAWEI_CLOUD_AK` / `HUAWEI_CLOUD_SK` or `hcloud configure` - **Region**: Via environment variable `HUAWEI_CLOUD_REGION` or `--region` parameter - **ECS IDs**: Comma-separated ECS instance IDs - **Alarm IDs**: Comma-separated alarm rule IDs - **Template**: Alarm template (web/database) - **Metric**: Monitoring metric name (cpu_util/mem_util/disk_usage) - **Threshold**: Alarm threshold value - **SMN Topic URN**: SMN topic URN for notifications ## Output Format - **Table**: Formatted table output (default) - **JSON**: JSON format for programmatic processing - **IDs**: Only ID list for scripting ## Verification Method After executing any operation, verify using the following methods: 1. **List Alarms**: `./scripts/list_alarms.sh --name-pattern <pattern>` 2. **Query Metrics**: `./scripts/batch_query_metrics.sh --ecs-ids <ids> --metric cpu_util` 3. **Check Notifications**: `./scripts/list_subscriptions.sh` See [references/troubleshooting.md](references/troubleshooting.md) for common verification issues. ## Best Practices 1. **Use Templates for Standard Scenarios**: Web/Database templates cover most use cases 2. **Configure Multiple Notification Channels**: Email + SMS for critical alarms 3. **Set Reasonable Thresholds**: CPU 80%, Memory 85%, Disk 90% recommended 4. **Use Environment Variables for Credentials**: Never hardcode AK/SK in scripts ## Common Issues ### Issue 1: hcloud Command Not Found **Solution**: Install KooCLI, see [references/cli-installation-guide.md](references/cli-installation-guide.md) ### Issue 2: 403 Forbidden **Solution**: Check IAM permissions, ensure `CES FullAccess` and `SMN FullAccess` policies are granted. See [references/iam-policies.md](references/iam-policies.md) ### Issue 3: Alarm Creation Fails **Solution**: Check metric name and threshold range. CPU/Memory thresholds should be 0-100. ### Issue 4: No Monitoring Data **Solution**: Check ECS instance status and metric collection interval. Data may have 5-minute delay. See [references/troubleshooting.md](references/troubleshooting.md) for more troubleshooting guides. ## Important Notes > **CLI Version Requirement**: Must use hcloud CLI v7.2.2 or later. Older versions may not support certain API parameter formats. > **Region Consistency**: All operations must specify the same region (`--cli-region` or `HUAWEI_CLOUD_REGION` environment variable). Cross-region operations will fail. > **Alarm Threshold Range**: CPU/memory utilization thresholds must be between 0-100. Disk usage threshold is recommended to be set between 80-95. > **Monitoring Data Delay**: CES monitoring data typically has a 5-minute delay. Querying real-time data may return empty results. > **SMN Subscription Creation**: > > - ✅ **Recommended**: Use `./scripts/create_email_subscription.sh` script, which automatically uses hcloud CLI configured credentials (no need to manually set environment variables) > - ✅ **Alternative**: Use Huawei Cloud Console (SMN → Topics → Subscribe) for subscription creation > - ⚠️ **Note**: Email/SMS subscriptions require confirmation before receiving notifications. Check your email and click the confirmation link. > > See [references/smn-subscription-guide.md](references/smn-subscription-guide.md) for detailed guide. > **Batch Operation Limits**: Single batch creation is recommended for no more than 20 ECS instances. Too many instances may cause API timeout. > **Credential Security**: > > - ✅ Recommended: Use `hcloud configure` to configure credentials > - ✅ Recommended: Use environment variables `HUAWEI_CLOUD_AK` / `HUAWEI_CLOUD_SK` > - ❌ Prohibited: Hardcode AK/SK in scripts or configuration files ## Related Documents - [CLI Installation Guide](references/cli-installation-guide.md) - [IAM Policies](references/iam-policies.md) - [Related APIs](references/related-apis.md) - [Troubleshooting](references/troubleshooting.md) - [SMN Subscription Guide](references/smn-subscription-guide.md) - [Common Commands](references/common-commands.md)