Skip to content

Detector catalog / Cost

UTIL

Right-sized cluster

A smaller cluster would run the same stages in about the same time.

Outcome
Cost
Scope
Judged on the whole run
Usual fix
A Spark configuration change
CI gate
No budget flag: gate it with --fail-on-introduced against a baseline

An example finding

Where you see it

Dashboard

The UTIL tag marks it in the action region of the dashboard, among the widgets that rank a fix. How to read it in the findings guide.

Agent (MCP)

An assistant can read this entry with the list_detectors tool and its background with get_finding_documentation. The call and the response below come from a real run of the MCP server.

Call

{
  "tool": "list_detectors",
  "arguments": {
    "type": "rightSizing"
  }
}

Response

{
  "count": 1,
  "detectors": [
    {
      "type": "rightSizing",
      "name": "right-sized cluster",
      "tag": "UTIL",
      "tagSharedWith": [
        "utilization"
      ],
      "family": "cost",
      "pitch": "A smaller cluster would run the same stages in about the same time.",
      "region": "action",
      "scope": "app",
      "fixEffort": "config",
      "thresholdSummary": "the model finds the stages run within 10% of their real time on at most 75% of the peak cores (model error under 20%)",
      "detectors": [
        {
          "detector": "rightSizing",
          "version": 1,
          "thresholds": {
            "tolerancePct": 10,
            "maxCoreShare": 0.75,
            "minBaselineCores": 8,
            "maxModelErrorPct": 20
          }
        }
      ],
      "pages": {
        "catalog": "docs/detectors/rightSizing.html",
        "guide": "docs/user-guide/understanding-findings.html#util"
      },
      "tuning": {
        "kind": "shared",
        "anchor": "#bottleneck-utilization",
        "path": "docs/tuning-reference/bottleneck-utilization.html#bottleneck-utilization"
      },
      "gate": null
    }
  ]
}

get_finding_documentation call

{
  "tool": "get_finding_documentation",
  "arguments": {
    "type": "rightSizing"
  }
}

Its response, with each Markdown body replaced by its length

{
  "type": "rightSizing",
  "name": "Right-Sized Cluster",
  "detectionDoc": {
    "tag": "UTIL",
    "title": "Low utilization",
    "content": "<1568 characters of Markdown>"
  },
  "tuningDoc": {
    "anchor": "#bottleneck-utilization",
    "title": "Executor Utilization",
    "content": "<11455 characters of Markdown>"
  }
}

CI (CLI)

List this entry from the command line. The output below is a real run of the command. Budgets and exit codes are in the CI guide.

sparkforensics-analyze detectors --type rightSizing --format md
# Detectors (1)

## Cost

| Tag | Type | Scope | Fix | Gate | What it finds |
| --- | --- | --- | --- | --- | --- |
| UTIL | `rightSizing` | app | config |  | A smaller cluster would run the same stages in about the same time. |

Report only this finding type for a run with --type:

sparkforensics-analyze <event-log> --type rightSizing --impact critical,warning,info

It has no budget flag. Fail a build on a new one by comparing against a baseline with --fail-on-introduced.

Airflow

The operator has no budget parameter for it. Use fail_on_introduced with a baseline.

check_spark_job = SparkForensicsOperator(
    task_id="check_spark_job",
    log_source=...,
    backend=SubprocessAnalyzeHook(),
    baseline_log_source=...,
    fail_on_introduced="critical",
)

The operator works per run, and its summary counts findings per impact band. See the operator for its parameters.

How it is measured

Thresholds

The model finds the stages run within 10% of their real time on at most 75% of the peak cores (model error under 20%).

rightSizing version 1

ThresholdDefault
tolerancePct10
maxCoreShare0.75
minBaselineCores8
maxModelErrorPct20

Each rule's impact bands and fixed fallbacks are in the threshold tables.

Override a default per run with --thresholds; see Tuning detector thresholds.

Docs