巡检查询示例（ClickHouse）
巡检查询示例（ClickHouse）
-- 量级与时效
SELECT
count() AS rows_1h,
max(ts) AS latest,
dateDiff('second', max(ts), now()) AS lag_seconds
FROM logs.events
WHERE ts >= now() - INTERVAL 1 HOUR;
-- 字段空值率
SELECT countIf(user_id = '' OR user_id IS NULL) / count() AS null_ratio
FROM logs.events
WHERE ts >= now() - INTERVAL 1 DAY;与历史基线对比（伪代码）
与历史基线对比（伪代码）
today = run_check("rows_1h")
baseline = median(last_14_days_same_hour("rows_1h"))
if today < baseline * 0.5 or today > baseline * 2:
alert("量级偏离基线", today=today, baseline=baseline)基线比固定阈值更稳：流量有周期和趋势，固定的"低于 N 条告警"会频繁误报或被忽略；按同时段历史分位数建基线。