Skip to main content
Glama

investigate_problem

Read-only

Diagnoses a Dynatrace problem by correlating root-cause entity, change events, error logs, and metrics, then returns findings, a Markdown summary, and next steps.

Instructions

One-shot RCA: correlates the problem's root-cause entity and evidence, change events (deployments, config, restarts) before the start, error logs in the problem window grouped by signature, and key metrics before vs during. Returns findings, a Markdown summary and next steps.

Input Schema

NameRequiredDescriptionDefault
log_limitNo
log_filterNoLog query clause for error logsstatus="ERROR"
problem_idYesProblem id (internal id or display id such as P-12345)
lookback_minutesNoMinutes before the problem start to include (changes, baseline metrics)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered; the description adds real value by disclosing what data gets gathered (change events in the lookback window, error logs grouped by signature, baseline vs during metrics) and what comes back (findings, Markdown summary, next steps). It does not mention cost, latency, or failure modes for an operation that fans out across several data sources.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the 'One-shot RCA' identity and then a compact enumeration of correlated sources; the return-value sentence is separated out cleanly. The middle clause list is dense but each element is meaningful and nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly takes on return-value disclosure (findings, Markdown summary, next steps), and annotations cover the read-only profile. The remaining shortfall is guidance on when to choose this composite over the granular sibling tools, which matters given how many related tools exist.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75% (problem_id, log_filter, and lookback_minutes are documented; log_limit only has bounds and a default), so the schema does most of the work. The description adds nothing parameter-specific -- 'before the start' loosely maps to lookback_minutes, and 'grouped by signature' hints at log_filter behavior, but there is no explicit param guidance to compensate for the log_limit gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb-and-resource ('One-shot RCA' that correlates root-cause entity, change events, error logs, and metrics for a problem), which is far more concrete than a bare name. It implicitly separates itself from granular siblings like get_problem_evidence or search_logs by enumerating everything it pulls together, but never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'One-shot RCA' and 'before vs during' imply this is the entry point for a full investigation, leaving the agent to infer that it should be called instead of chaining get_problem_evidence, search_logs and query_metrics manually. There is no explicit when-to-use/when-not guidance, no mention of cost or latency, and no named alternatives despite ten-plus relevant siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.