bt-site-ops

Baota Website Diagnostic Expert

Diagnostic Process (5 Steps)

Step 1: Basic Health Snapshot

# 系统级
uptime
free -m
df -h
top -bn1 | head -20

# 网站服务
systemctl status nginx
systemctl status php-fpm
systemctl status mysqld

Network Listening

ss -tlnp | grep -E ':80|:443|:9000|:3306'

### 第二步：Nginx/Apache 配置审计

```bash
# vhost 配置位置
ls /www/server/panel/vhost/nginx/        # Nginx
ls /www/server/panel/vhost/apache/       # Apache

# 检查语法
nginx -t
apachectl configtest

# 检查关键配置项
grep -E "fastcgi_pass|root\s|listen\s|ssl_certificate" /www/server/panel/vhost/nginx/<site>.conf

Step 3: PHP-FPM Status

# 进程数
ps aux | grep php-fpm | wc -l

# 慢日志
ls -la /www/server/php/<ver>/var/log/
tail -100 /www/server/php/74/var/log/php-fpm.slow.log 2>/dev/null

# 错误日志
tail -100 /www/server/php/74/var/log/php-fpm.log

# 配置
grep -E "pm.max_children|pm.start_servers|request_terminate_timeout" /www/server/php/74/etc/php-fpm.conf

Step 4: MySQL Slow Queries

# 慢查询日志
ls -la /www/server/mysql/mysql<ver>.log
tail -100 /www/server/data/mysql-slow.log 2>/dev/null

# 进程列表
mysqladmin -uroot -p<pwd> processlist

# 关键配置
mysql -e "SHOW VARIABLES LIKE 'slow_query_log'"
mysql -e "SHOW VARIABLES LIKE 'max_connections'"
mysql -e "SHOW STATUS LIKE 'Threads_connected'"

Step 5: Comprehensive Analysis and Repair Recommendations

Common Issues and Fixes

502 Bad Gateway

Symptom: Website returns 502

Root Cause Investigation：

1. PHP-FPM not running:systemctl status php-fpm
2. Port not listening:ss -tlnp | grep 9000
3. Incorrect fastcgi_pass path in vhost
4. PHP-FPM process count exhausted (pm.max_children insufficient)

Fix：

# 重启 PHP-FPM
systemctl restart php-fpm

# 调大进程数（按内存算：每进程约 30MB）
sed -i 's/pm.max_children = .*/pm.max_children = 50/' /www/server/php/74/etc/php-fpm.conf
systemctl reload php-fpm

Website responds slowly

Diagnostic Path：

1. Network layer: Use curl -w "time_total: %{time_total}\n" -o /dev/null -s <site> to test response time
2. Database layer: Check slow queries, connection count, lock waits
3. PHP layer: Check PHP-FPM slow log, whether OPcache is enabled
4. Disk layer：iostat -x 1 5、iotop
5. Application layer: Enable XHProf / Tideways tracing

Common Optimizations：

# 启用 OPcache
grep "opcache.enable" /www/server/php/74/etc/php.ini
# 应为 opcache.enable=1

# 检查静态资源缓存
grep -E "expires|cache-control" /www/server/panel/vhost/nginx/<site>.conf

SSL Certificate Issues

# 检查证书有效期
openssl x509 -text -noout -in /www/server/panel/vhost/cert/<site>/fullchain.pem | grep -E "Not Before|Not After"

# 检查证书链
openssl s_client -connect <site>:443 -servername <site> < /dev/null 2>&1 | grep -E "Verify return code|subject=|issuer="

# Let's Encrypt 续签
certbot renew --dry-run

Disk Full

# 找出大目录
du -sh /www/* | sort -hr | head -10
du -sh /www/wwwlogs/* | sort -hr | head -10  # 访问日志
du -sh /www/server/mysql/data/* | sort -hr | head -10  # 数据库

# 清理日志（保留最近 7 天）
find /www/wwwlogs -name "*.log" -mtime +7 -delete

MCP Integration Tool Mapping

If baota-mcp is already connected:

• SiteList → List all sites
• SiteGetConfig → Get the complete configuration of a single site
• SiteLogs → Get access/error logs
• SiteTraffic → Get traffic data
• SiteSSLDeploy → One-click certificate deployment
• SiteSSLApply → Apply for Let's Encrypt

Output Template

Diagnostic Report:

1. Symptom(what the user reported + what you observed)
2. Evidence(command output snippets, log lines, configuration snippets)
3. Root cause(points to a specific configuration item or resource bottleneck)
4. Repair steps(ordered from low to high risk)
5. Verification method(how to confirm the issue is resolved after repair)
6. Preventive recommendations(how to avoid recurrence)

When to Use

✅ Applicable:

1. The user explicitly wants to diagnose Baota website, Nginx, PHP-FPM, database, and certificate failures.
2. Necessary context has been provided or can be safely obtained, and a verifiable site-diagnosis-report。
3. Needs to be executed with least privilege and in a rollback-capable manner, with audit evidence retained.

⚠️ Clarify first:

1. When the target environment, authorization boundary, or success criteria are missing, first provide a read-only assumption plan and list the missing items.
2. When production environment changes are involved, first confirm backups, maintenance windows, and rollback paths.
3. When the input may contain sensitive information, only reference field names and redacted snippets; do not copy complete credentials.

❌ Should not be used:

1. Restarting production services or rewriting site configurations without confirming the scope of impact.
2. The user only wants a conceptual explanation and has no execution or delivery requirement.
3. Requests that require bypassing authentication, certificate validation, manual confirmation, or other security controls.

Workflow

Step 1: Confirm the objective, environment, authorization scope, and immutable constraints; when information is insufficient, first produce a read-only version with assumptions.

Step 2: Inventory the current state and dependencies, read only necessary data, and do not record tokens, passwords, cookies, or complete personal data.

Step 3: Choose the path with the least impact, and clearly mark high-risk actions, external network calls, and reversible steps.

Step 4: Generate or execute site-diagnosis-report, binding each step to its inputs, expected outputs, and failure conditions.

Step 5: Validate the structure, sources of facts, and target state; do not fabricate successful conclusions based on missing evidence.

Step 6: On failure, stop expanding the impact and output the completed steps, failure evidence, recovery point, and conditions for the next safe retry.

Step 7: Deliver a summary, verification evidence, remaining risks, and follow-up actions; production changes must state whether rollback has been verified.

Rules

• Read-only by default; write operations, high-risk operations, and paid calls must obtain explicit authorization matching the action.
• This skill does not collect, store, or upload user credentials; logs and reports must not contain complete tokens, passwords, or keys.
• Do not disable TLS verification, do not execute scripts of unknown origin, and do not use pipe downloads for direct execution.
• Only write actual execution results as "completed"; plans, examples, and inferences must be explicitly marked.
• Prefer idempotent operations; when idempotence is not possible, first provide a dry run, backup, and rollback point.

Validation checklist

• The objective, environment, and authorization scope are all stated.
• 故障层级、根因证据、修复建议和验证请求完整 Verified by reproducible evidence.
• Sensitive data is redacted, and the output contains no complete credentials.
• Failure and timeout paths are covered, with no infinite retries.
• Change-type tasks include backup or rollback instructions.
• The final conclusion distinguishes facts, inferences, and unverified items.

Gotchas

1. Authorization does not equal reachability: when permission exists but the network, certificate, or allowlist requirements are not met, you should still stop and report connection evidence.
2. A success code does not equal business success: you must check 故障层级、根因证据、修复建议和验证请求完整, and cannot look only at the command exit code or HTTP 200.
3. Retry does not equal recovery: do not blindly retry authentication failures, parameter errors, or security denials.
4. Examples do not equal the current state: template values and placeholders must not be written as real environment data.
5. Output does not equal delivery: structural validation, risk explanation, and reproducible verification must also be completed.
6. Cross-environment reuse is not allowed: when the operating system, version, region, and host capabilities differ, parameters must be reconfirmed.

Progressive materials

• Before choosing a path, read references/decisions/decision-guide.md。
• When encountering exceptions, timeouts, or partial success, read references/operations/failure-matrix.md。
• Before completing delivery, read references/operations/validation-checklist.md。
• When reusable input is needed, refer in order to examples/basic.md、examples/failure.md、examples/advanced.md。