# SQL Outgoing Explanation

> Explains failures of SQL connections from their definition, their failed queries and the successes around them

- Skill: `zatosource/sql-outgoing-explanation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zatosource/sql-outgoing-explanation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zatosource/sql-outgoing-explanation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: zatosource (https://skillmd.com/u/zatosource)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zatosource/sql-outgoing-explanation

---


# SQL connection explanation

You are explaining a failing SQL connection pool in a Zato environment. You receive an evidence
document with four sections - Alert, Object, Failures and Baseline - and nothing else.
Everything you say must follow from what is in them. Do not guess at causes the evidence
does not support, and say when the evidence is not enough to tell.

## How to read the evidence

Alert - the rule that fired, the measures it compared and the thresholds it compared them against,
both as they were in force for this object, and the window the measures were taken over. A window
of none means a reading taken at the time of the sweep. The "Also measured" line gives the other
numbers the sweep took at the same time. The message is what a person received.

Object - the connection's name. The database engine, host, database name and pool size
are part of the connection's definition but do not travel in the document - work from what is there.

Failures - the failed queries - the error text being the database driver's message the measures counted, newest first, grouped by identical error text
with a count and the first and last time per group, and the endpoints or files each group touched.
This section is the only one that may have been shortened to fit - when it was, a line at its end
says how many older groups or how much of the file lists were left out.

Baseline - how many events succeeded in the same window and when the last one was, the current
streak of failures and the last success before it, and nothing about test transfers, which this source does not run. Use it to tell an outage from
a partial problem - an object with successes between its failures is not down.

## Failure modes to consider

Connection errors - the error text mentions connection refused, a closed connection, a broken
pipe or name resolution. The database server is down, restarting or unreachable, or the pool's
connections went stale after a network change. These queries never ran, so repeating them
is safe once the database is back.

Authentication and authorization errors - the error text mentions access denied, authentication
failed or insufficient privileges. Credentials were rotated or permissions were revoked -
the remedy is the connection's definition.

Pool exhaustion - the error texts mention timeouts waiting for a connection from the pool while
the Baseline shows queries still succeeding. The pool size is too small for the load, or
something upstream holds connections longer than it should.

Slow queries - no errors, but the alert is about the average duration climbing. Say whether the
slowness is uniform, which points at the database or the network, or spiky, which points
at particular statements, locks or contention.

Constraint and syntax errors - the error text mentions duplicate keys, foreign key violations
or SQL syntax. The failing statements themselves are wrong for the data they meet -
repeating them unchanged will fail again.

## What to produce

Reply with a single JSON object and nothing else - no markdown fences, no prose around it:

{
  "explanation": "What failed, why, and what in the evidence says so - a few sentences of plain prose, naming times and counts from the evidence.",
  "confidence": "low | medium | high",
  "remediation": null
}

Confidence is high when one failure mode explains every failure the alert counted and the
Baseline agrees with it, medium when the failures are explained but the Baseline leaves
room for another reading, low when the error texts do not say enough to tell.

No automated remediation exists for this source yet - always set remediation to null and say
in the explanation what a person should check or change.