Diagnose System Lag

System lag diagnosis

Short-path, read-only diagnosis for lag, slowness, resource pressure, or a recent unexpected reboot on this host.

Out of scope: full sos collection, long-running health baselines, cloud VPC troubleshooting, auto config changes or killing processes. Use sosreport-analyzer, deepin-sysassist, or other skills for those.

Rules

1. Read-only: do not change config, kill processes, drop caches, tune sysctl, or unload modules.
2. Symptom-first: decide what to probe from the user's report; do not run a fixed full command list every time.
3. Stop when enough: stop once the symptom is explained and key objects (process / mount / device) are named.
4. Follow-ups fill gaps only: the next probe answers “what is still missing”, not “scan every focus again”.
5. Advice needs confirmation: prefer action targets; give concrete kill/restart commands only if asked, and remind the user to save work.
6. Isolated sessions: do not run report-writing scripts under this skill (for example scripts/diagnose.sh).
7. Honest probes: if a tool is missing or a probe fails, state that in Evidence—do not treat it as “no problem found”.

Workflow

Understand symptom → quick check (only if vague) → focused probes → answer
                         ↑ stop when evidence is enough ↑

1. Understand the symptom

Named apps (browser, WPS, Java, a service) are suspects under the matching focus—not a separate workflow.

2. Quick check (vague symptoms only)

nproc
uptime
free -h
df -h
vmstat 1 5
ps -eo pid,ppid,comm,%cpu,%mem,state --sort=-%cpu | head -15
ps -eo pid,ppid,comm,%cpu,%mem,state --sort=-%mem | head -15

Then decide:

3. Focused probes

Add only the set that fills the current gap. If a tool is missing, skip it and note the fallback in the answer.

Memory

free -h
swapon --show
ps -eo pid,user,comm,rss,%mem --sort=-rss | head -20
journalctl -k -b --no-pager | grep -iE 'out of memory|oom|killed process' | tail -30

If still missing “who was killed / cache vs anon”:

grep -E 'MemTotal|MemAvailable|Buffers|Cached|AnonPages|Shmem|SwapTotal|SwapFree' /proc/meminfo
df -h /dev/shm /run /tmp

Disk

vmstat 1 5
iostat -xz 1 5
df -h
ps -eo pid,state,comm,wchan:32 | awk '$2=="D" || $2=="d"' | head -20

Skip iostat if missing and note that in Evidence. If still missing “who is writing” and the tool exists: pidstat -d 1 5 or iotop -boPqqq -n 3.

CPU

nproc; uptime
vmstat 1 5
ps -eo pid,user,comm,state,%cpu,%mem --sort=-%cpu | head -20

If still missing “what it waits on”, for a suspect PID: cat /proc/<pid>/wchan.

Local network (only when the user mentions network)

ip -s link
ss -s
ss -tnp | head -30

Inspect local sockets and error/retransmit counters first. For full path quality to a remote target, prefer network-path-diagnose.

Incident (sudden reboot / crash recovery)

Start with last -x. Prefer specific signatures (OOM killed process, kernel panic, I/O error)—not generic error/fail/hung alone.

last -x | head -20
journalctl -b -1 -p warning..alert --no-pager | tail -80
journalctl -k -b -1 --no-pager | grep -iE 'Out of memory|Killed process|Kernel panic|Oops:|I/O error' | tail -40

Correlated OOM/panic/I/O → conclude from that. Otherwise inconclusive; suggest re-running after the next incident or using sosreport-analyzer.

4. Threshold hints (secondary to evidence)

• CPU: load stays > nproc × 1.5 and idle < 20% → CPU pressure
• I/O: sustained wa > 5%, or very high device %util → I/O pressure
• Memory: very low MemAvailable, or Swap used ≥ 50% / ≥ 2GB → memory pressure
• Disk space: root or home ≥ 90% → full-disk risk

Thresholds help; conclusions must follow this run’s samples and logs.

Output format

## Conclusion
1–2 sentences: whether something is wrong, main cause, blast radius.

## Evidence
- Only metrics/processes/logs that support the conclusion
- Label timing: current sample / current boot logs / previous boot logs
- Note unavailable or failed probes when relevant

## Recommendations
- Short-term action targets (close user apps, free space, etc.)
- Concrete commands only if asked; warn before kill
- Never recommend stopping: Xorg, wayland, dde-*, systemd, dbus, NetworkManager, fcitx5/ibus

If the system looks healthy, still use this skeleton; say no action needed instead of inventing problems. Reply in the user's language.

Desktop app hints

Examples

User: Desktop freezes while copying a large file

1. Focus → disk (skip a blind full check)
2. Disk probes → high wa, D state processes, busy disk
3. Enough → stop
4. Conclude I/O saturation; suggest off-peak copy / check free space and disk health

User: Screen went black briefly; did it crash?

1. Focus → incident
2. Previous-boot journals + last -x
3. OOM → memory pressure + suspect process; no clue → say evidence is insufficient and offer next steps