Observability Analysis¶

TOBY AI TruePilot can combine the context of the current page with the workspace data that the current user is authorized to access to summarize observable objects, analyze anomalies, and localize root causes. This page also covers the AI aggregation capability that is automatically executed by alert policies. Different capabilities correspond to different data entry points and result formats. Before using a capability, you should first enter the page or business process you want to analyze.

Page Analysis and Root Cause Localization¶

When you are viewing an abnormal data record and want to quickly understand the symptom, assess possible causes, or determine the next troubleshooting direction, you can open TOBY AI TruePilot directly on the current page.

This capability currently covers the following types of pages:

• Alert events, Error Center, and incidents;
• Log and trace details;
• Dashboards;
• RUM sessions, pages, resources, actions, long tasks, and errors;
• Security signals;
• Hosts, containers, Kubernetes objects, processes, and database objects;
• Network Summary, topology, network flows, network devices, and network paths;
• Database Query details. For SQL optimization rules, see Database Query Optimization.

The actual supported scope depends on whether the current page provides analysis context to TOBY AI TruePilot.

Analyze the Current Page¶

1. Open the detail page you want to analyze and adjust the page time range to the period you need.
2. Open TOBY AI TruePilot, click the suggested analysis prompt provided on the page, or directly describe the analysis goal.
3. If you have specific concerns, add the impact scope to assess, related services, the anomaly period, or the expected output.

The following pages may show the corresponding suggested analysis prompts:

After you start entering other content, send a message, switch objects, or close the panel, the suggested prompt disappears. The same object is prompted only once in the same panel session. After the prompt disappears, you can still enter the same goal directly.

Analysis Results¶

TOBY AI TruePilot first reads the current object, and then queries related evidence in the same time range as needed. For confirmed anomalies, the results usually include:

1. The current object and the anomaly symptom;
2. The most likely root cause or risk direction and its confidence;
3. Log, metric, trace, or event evidence supporting the conclusion;
4. The known impact scope;
5. Actionable verification and handling recommendations.

If the current object has no clear anomaly, TOBY AI TruePilot provides a summary and risk description, and does not assume a fault just to produce a root cause analysis. When evidence is insufficient, the results point out the unconfirmed parts and the data that needs to be supplemented.

Detect Suspected App Blank Screen Issues¶

When analyzing app pages or sessions, TOBY AI TruePilot combines data such as page loading, errors, and resource requests to help detect suspected blank screen issues and surface related clues in the analysis results. You do not need to confirm that a blank screen has occurred before asking it to check whether page content is not displayed properly within the current scope.

1. In RUM, select the target application and set the time range and filter conditions you need.
2. Enter the page or session explorer, open a specific record as needed, and then open TOBY AI TruePilot.
3. Describe the analysis goal, for example: "Check the app access in the last 30 minutes, find pages with suspected blank screens, and explain the related clues and troubleshooting recommendations."

Once relevant clues are found, the results explain the involved pages or sessions, the evidence supporting the judgment, possible causes, and next-step inspection recommendations. If user feedback already exists, you can add the occurrence time, app version, device, and operation steps to help narrow the scope.

Suspected blank screen indications need to be further confirmed against actual access behavior. Slow page loading, failed requests, or missing data alone cannot prove that a blank screen has occurred. The analysis results are also not to be used as a statistical basis for an accurate blank screen rate.

Analyze Infrastructure Pages¶

On supported infrastructure pages, TOBY AI TruePilot can combine the current object, time range, and filter conditions to help you understand resource status and communication conditions. The currently supported pages include:

• Lists and details of hosts, containers, Kubernetes objects, and processes;
• Lists and details of database objects;
• Lists and details of the Network Summary, topology, network flows, network devices, and network paths.

When using it, first set the time range and filter conditions on the page, and then open TOBY AI TruePilot to describe the analysis goal. For example, you can ask: "Which hosts need priority attention right now?", "Does this container have resource pressure?", or "Where are the problems on this network path concentrated?"

Within the data scope provided by the current page, TOBY AI TruePilot organizes object status, resource usage, top distributions, or communication quality, and distinguishes confirmed facts, possible risk directions, and still-missing evidence. When the page does not provide the necessary fields or there is no data in the current scope, the results explain the limitation and do not directly treat missing data as indicating that resources are normal or abnormal.

The database object page is used to analyze the current status, capacity, and performance clues of an instance or resource. If you need to analyze why a specific SQL is slow or whether the execution plan is reasonable, enter the database Query detail page and refer to Database Query Optimization.

Analyze Dashboards¶

When analyzing a dashboard, TOBY AI TruePilot combines the current time range, filter conditions, and chart content to organize the main trends, abnormal changes, and objects worth further inspection. Before starting the analysis, it is recommended to adjust the dashboard to the business scope you want to focus on. If you only care about some charts, you can state this directly in your question.

The analysis is affected by factors such as data volume and query complexity. When there is a large amount of data, you can narrow the time range or specify the charts to analyze.

The trends and anomaly judgments derived from dashboard analysis apply only to the analysis scope stated in the results. For important business judgments or production handling, you should still return to the original charts to verify key data.

List and Asset Analysis¶

When a single record is not enough to explain the overall situation, or when you need to find anomaly distributions, top objects, and common characteristics from the current list, you can ask TOBY AI TruePilot to analyze the current list.

This capability can be used for dashboards, logs, traces, RUM, alert events, security signals, Error Center, incidents, and supported infrastructure list pages. The specific fields and objects that can be analyzed are determined by the filter conditions and data scope provided by the current page.

Analyze the Current List¶

1. Set the time range and filter conditions on the list page so that the list stays within the business scope you need to analyze.
2. Open TOBY AI TruePilot and describe the conclusion you want, for example: "Summarize the anomaly distribution of the current list", "Find the service with the most errors", or "Analyze the common characteristics of recent events".
3. When comparison or sorting is needed, specify the grouping dimension, the metric of interest, or the top count.

TOBY AI TruePilot follows the query boundary of the current page and prioritizes running aggregations or sampling a small number of records instead of reading all details without boundaries.

If sampling is used, the results explain the actual covered data scope. If you need to inspect all objects, you can narrow the time range or filter scope and analyze again.

Analysis Results¶

The results usually include an overview of the current scope, key counts, top distributions, representative samples, risk descriptions, and next-step recommendations. When the list does not have enough fields, the query fails, or the results are empty, TOBY AI TruePilot preserves the current facts and explains the evidence gap.

List analysis does not change the current filter conditions and does not perform batch operations on list objects.

Database Query Optimization¶

When the database Query detail page shows excessive query time, overly large scan volume, or abnormal execution performance, you can use this capability to analyze the SQL and execution plan.

Run Optimization Analysis¶

1. Open the target database Query detail page.
2. Open TOBY AI TruePilot and enter "Analyze the current SQL", "Why is this Query slow", or "Provide optimization recommendations based on the execution plan".
3. If there is a clear goal, such as reducing scanned rows, improving index usage, or reducing sorting overhead, you can include it in the question.

Analysis Results¶

TOBY AI TruePilot analyzes the data already available in the current Query details. The results can include:

• Available statistics such as database type, query time, call count, scanned rows, and returned rows;
• The original SQL;
• The returned execution plan and key fields;
• Recommendations on query rewriting, indexes, filter conditions, or execution methods.

If the current details do not return an execution plan, TOBY AI TruePilot presents the available SQL and explains the missing evidence, without fabricating execution nodes or costs. This capability provides analysis and recommendations only. It does not automatically execute rewritten SQL or modify database objects.

Alert Aggregation and Compression¶

When a large number of duplicate or related alerts are generated in the same period, and reading them one by one makes it difficult to identify the main issue, you can enable AI Aggregation in the alert policy. The system classifies, deduplicates, and summarizes alerts within the configured aggregation period, and then sends aggregation notifications according to the alert policy. This capability is automatically executed by the alert policy and does not require opening TOBY AI TruePilot or starting a conversation.

This capability focuses on identifying:

• Alerts repeatedly triggered by the same monitor;
• Related alerts generated by the same host, application, service, or dependency;
• Common categories such as cloud platforms, infrastructure, Kubernetes, middleware, databases, logs, traces, and delivery pipelines;
• High-frequency objects and anomalies that require priority attention.

Aggregation Results¶

The system generates structured results based on the aggregation time range and the input alert set, including:

• The number of monitors that triggered alerts and the number of alert notifications within the aggregation period;
• Monitors organized by anomaly type, representative titles, and classification summaries;
• Descriptions of associations between high-frequency hosts, applications, or services;
• Recommendations for duplicate alerts, related anomalies, and priority investigation objects.

Events with a recovered status can be used to indicate that an issue has recovered, but they are not counted in the number of anomaly alerts and are not used as the primary basis for root cause recommendations. Aggregation results are based only on the alert content passed in this time and cannot replace further verification of the original metrics, logs, and traces.

Preliminary Incident Analysis¶

In the scenario where an incident is generated from the Incident Center, you can use TOBY AI TruePilot to generate a structured initial assessment based on the passed-in incident details, helping the responder quickly understand the issue background and begin troubleshooting.

Preliminary Analysis Results¶

When this capability is enabled in the current process, TOBY AI TruePilot extracts available information from the incident details and organizes the following content based on actual data:

• Incident title, status or severity, and first occurrence time;
• Detection time range, affected objects, and key metric snapshots;
• Possible causes ordered by priority;
• Recommendations for urgent investigation, change review, and process escalation.

The preliminary analysis uses only the incident details passed in by the current incident process. When time, severity, impact scope, or metrics are missing, the corresponding content is omitted and the uncertainty is clearly stated. No data is fabricated.