99 lines
2.9 KiB
SQL
99 lines
2.9 KiB
SQL
-- Operational proof snapshot for DetMir/AWatch-rus.
|
|
-- Output is aggregate-only: no users, company names, hosts, domains, paths,
|
|
-- evidence content, tokens, passwords or raw incident payloads.
|
|
|
|
SELECT
|
|
database,
|
|
count() AS tables_total,
|
|
sum(total_rows) AS rows_total,
|
|
formatReadableSize(sum(total_bytes)) AS compressed_size,
|
|
formatReadableSize(sum(total_bytes_uncompressed)) AS uncompressed_size
|
|
FROM system.tables
|
|
WHERE database = 'analytics_1c'
|
|
AND engine NOT IN ('View')
|
|
GROUP BY database;
|
|
|
|
SELECT
|
|
version() AS clickhouse_version,
|
|
uptime() AS uptime_seconds,
|
|
(SELECT count() FROM system.tables WHERE database = 'analytics_1c') AS analytics_objects,
|
|
formatReadableSize((
|
|
SELECT sum(total_bytes)
|
|
FROM system.tables
|
|
WHERE database = 'analytics_1c'
|
|
AND engine NOT IN ('View')
|
|
)) AS analytics_compressed_size;
|
|
|
|
SELECT
|
|
count() AS queries_logged,
|
|
min(event_time) AS first_query,
|
|
max(event_time) AS last_query,
|
|
quantile(0.5)(query_duration_ms) AS p50_ms,
|
|
quantile(0.95)(query_duration_ms) AS p95_ms,
|
|
max(query_duration_ms) AS max_ms
|
|
FROM system.query_log
|
|
WHERE event_time >= now() - INTERVAL 7 DAY
|
|
AND type = 'QueryFinish'
|
|
AND current_database = 'analytics_1c';
|
|
|
|
SELECT 'business_events' AS table_name, count() AS rows, min(ts) AS min_ts, max(ts) AS max_ts
|
|
FROM analytics_1c.business_events
|
|
UNION ALL
|
|
SELECT 'document_change_events', count(), min(ts), max(ts)
|
|
FROM analytics_1c.document_change_events
|
|
UNION ALL
|
|
SELECT 'detections', count(), min(ts), max(ts)
|
|
FROM analytics_1c.detections
|
|
UNION ALL
|
|
SELECT 'cases', count(), min(opened_at), max(opened_at)
|
|
FROM analytics_1c.cases
|
|
UNION ALL
|
|
SELECT 'company_health_signals', count(), min(generated_at), max(generated_at)
|
|
FROM analytics_1c.company_health_signals
|
|
UNION ALL
|
|
SELECT 'company_forecasts', count(), min(generated_at), max(generated_at)
|
|
FROM analytics_1c.company_forecasts
|
|
ORDER BY table_name;
|
|
|
|
SELECT
|
|
countDistinct(infobase) AS infobases,
|
|
countDistinct(user) AS users_in_reglog,
|
|
countDistinct(host) AS hosts_in_reglog,
|
|
count() AS reglog_events,
|
|
min(ts) AS min_ts,
|
|
max(ts) AS max_ts
|
|
FROM analytics_1c.reglog_events;
|
|
|
|
SELECT
|
|
countDistinct(infobase) AS infobases,
|
|
countDistinct(company_entity_key) AS company_entities,
|
|
countDistinct(document_id) AS documents,
|
|
countDistinct(user) AS users,
|
|
count() AS business_events,
|
|
min(ts) AS min_ts,
|
|
max(ts) AS max_ts
|
|
FROM analytics_1c.business_events;
|
|
|
|
SELECT
|
|
severity,
|
|
status,
|
|
count() AS detections
|
|
FROM analytics_1c.detections
|
|
GROUP BY severity, status
|
|
ORDER BY detections DESC;
|
|
|
|
SELECT
|
|
severity,
|
|
status,
|
|
count() AS cases
|
|
FROM analytics_1c.cases
|
|
GROUP BY severity, status
|
|
ORDER BY cases DESC;
|
|
|
|
SELECT
|
|
countDistinct(company_key) AS registry_companies,
|
|
countIf(key_contour = 1) AS key_contour_rows,
|
|
countDistinct(assignee_name) AS assignees,
|
|
max(ts) AS last_snapshot
|
|
FROM analytics_1c.company_registry;
|