Labsco
microsoft logo

spark-operations-cli

✓ Official729

by microsoft · part of microsoft/skills-for-fabric

Diagnose failed Spark jobs, unhealthy Livy sessions, and performance bottlenecks in Microsoft Fabric via read-only CLI triage. Use when the user wants to: (1) diagnose why a Spark job, notebook run, or Lakehouse job failed, (2) triage stuck or dead Livy sessions, (3) identify OOM, shuffle spill, or data skew, (4) retrieve driver and executor logs or Spark Advisor findings, (5) copy event logs and start a local Spark History Server, (6) diagnose all Spark activities within a failed pipeline run.

🧩 One of 7 skills in the microsoft/skills-for-fabric package — works on its own, and pairs well with its siblings.

This is the playbook your agent receives when the skill activates — you don't need to read it to use the skill, but it's here to audit before installing.

Update Check — ONCE PER SESSION (mandatory) The first time this skill is used in a session, run the check-updates skill before proceeding.

  • GitHub Copilot CLI / VS Code: invoke the check-updates skill.
  • Claude Code / Cowork / Cursor / Windsurf / Codex: compare local vs remote package.json version.
  • Skip if the check was already performed earlier in this session.

CRITICAL NOTES

  1. To find the workspace details (including its ID) from workspace name: list all workspaces and, then, use JMESPath filtering
  2. To find the item details (including its ID) from workspace ID, item type, and item name: list all items of that type in that workspace and, then, use JMESPath filtering
  3. Skill disambiguation: spark-operations-cli is for read-only triage and diagnosis of existing jobs and sessions. For creating notebooks, running new jobs, or Spark development, use spark-authoring-cli. For interactive PySpark analysis and Livy session creation, use spark-consumption-cli.

Spark Operations — CLI Skill

This skill provides diagnostics for Microsoft Fabric Spark job failures, Livy session health, and performance bottlenecks using Fabric REST APIs and CLI tools (az rest). All diagnostic operations are read-only; session cleanup (e.g., stopping zombie sessions) requires explicit user confirmation. For Spark development and notebook authoring, use spark-authoring-cli. For interactive PySpark analysis, use spark-consumption-cli.

Table of Contents

The TOC is grouped by purpose. Start at Diagnostic Workflows when triaging an active failure; the earlier sections are foundational references.

1. Fabric Foundations (concepts)

TaskReferenceNotes
Fabric Topology & Key ConceptsCOMMON-CORE.md § Fabric Topology & Key Concepts
Environment URLsCOMMON-CORE.md § Environment URLs
Authentication & Token AcquisitionCOMMON-CORE.md § Authentication & Token AcquisitionWrong audience = 401; read before any auth issue
Core Control-Plane REST APIsCOMMON-CORE.md § Core Control-Plane REST APIs
PaginationCOMMON-CORE.md § Pagination
Long-Running Operations (LRO)COMMON-CORE.md § Long-Running Operations (LRO)
Rate Limiting & ThrottlingCOMMON-CORE.md § Rate Limiting & Throttling
Job ExecutionCOMMON-CORE.md § Job Execution
Capacity ManagementCOMMON-CORE.md § Capacity Management
Gotchas & TroubleshootingCOMMON-CORE.md § Gotchas & Troubleshooting
Best PracticesCOMMON-CORE.md § Best Practices

2. CLI Setup & Authentication

TaskReferenceNotes
Tool Selection RationaleCOMMON-CLI.md § Tool Selection Rationale
Finding Workspaces and Items in FabricCOMMON-CLI.md § Finding Workspaces and Items in FabricMandatoryREAD link first [needed for finding workspace id by its name or item id by its name, item type, and workspace id]
Authentication RecipesCOMMON-CLI.md § Authentication Recipesaz login flows and token acquisition
Fabric Control-Plane API via az restCOMMON-CLI.md § Fabric Control-Plane API via az restAlways pass --resource https://api.fabric.microsoft.com or az rest fails
Pagination PatternCOMMON-CLI.md § Pagination Pattern
Long-Running Operations (LRO) PatternCOMMON-CLI.md § Long-Running Operations (LRO) Pattern
Gotchas & Troubleshooting (CLI-Specific)COMMON-CLI.md § Gotchas & Troubleshooting (CLI-Specific)az rest audience, shell escaping, token expiry
Quick Reference: az rest TemplateCOMMON-CLI.md § Quick Reference: az rest Template
Quick Reference: Token Audience / CLI Tool MatrixCOMMON-CLI.md § Quick Reference: Token Audience ↔ CLI Tool MatrixWhich --resource + tool for each service

3. Spark Sessions, Notebooks & Jobs (background)

TaskReferenceNotes
Livy Session ManagementSPARK-CONSUMPTION-CORE.md § Livy Session ManagementSession creation, states, lifecycle, termination
Interactive Data ExplorationSPARK-CONSUMPTION-CORE.md § Interactive Data ExplorationStatement execution, output retrieval, data discovery
Notebook Execution & Job ManagementSPARK-AUTHORING-CORE.md § Notebook Execution & Job Management

4. Spark Monitoring APIs (primary triage surface)

TaskReferenceNotes
Spark Monitoring API OverviewSPARK-MONITORING-CORE.md § OverviewGA monitoring APIs — no active session required
Workspace & Item Session ListingSPARK-MONITORING-CORE.md § Workspace and Item-Level Session ListingList Spark apps across workspace with filtering
Spark Advisor APISPARK-MONITORING-CORE.md § Spark Advisor APIKey — automated skew detection, task errors, recommendations
Open-Source Spark History Server APIsSPARK-MONITORING-CORE.md § Open-Source Spark History Server APIsJobs, stages, executors, SQL queries via REST
Driver and Executor Log APIsSPARK-MONITORING-CORE.md § Driver and Executor Log APIsDirect log retrieval without active session
Livy Log APISPARK-MONITORING-CORE.md § Livy Log APISession-level log with byte-offset pagination
Resource Usage APISPARK-MONITORING-CORE.md § Resource Usage APIvCore timeline, idle/running cores, efficiency metrics
Monitoring Diagnostic WorkflowSPARK-MONITORING-CORE.md § Diagnostic Workflow Using Monitoring APIsStep-by-step triage using monitoring APIs

5. Diagnostic Workflows (start here for active triage)

TaskReferenceNotes
Automated Diagnostic Workflow (full)automated-diagnostic-workflow.mdSteps 1–7: resolve → route by state → failure/perf/resource/health → report. Includes Step 1b expired-data fallback and report templates
Diagnostic Tiersdiagnostic-workflow.md § Diagnostic TiersTier 1 (online REST) vs Tier 2 (local SHS)
Key Diagnostic Patternsdiagnostic-workflow.md § Key Diagnostic PatternsSymptom → first check → likely cause lookup
Severity Thresholdsdiagnostic-workflow.md § Severity ThresholdsMetric thresholds for classifying findings
Manual CLI Recipesdiagnostic-workflow.md § Manual CLI RecipesAd-hoc diagnostic commands for manual use
Pipeline Run Diagnosispipeline-diagnosis.mdDiagnose all Spark activities within a pipeline run (Steps P1–P6)

6. Job Failure Diagnostics

TaskReferenceNotes
Failure Triage Workflowjob-diagnostics.md § Failure Triage WorkflowStep-by-step decision tree for diagnosing failures
Job Failure Classificationjob-diagnostics.md § Failure ClassificationOOM, shuffle, timeout, dependency, configuration errors
Reading Spark Logs via RESTjob-diagnostics.md § Reading Spark Logs via RESTDriver/executor log retrieval from Livy
Job Instance Historyjob-diagnostics.md § Job Instance HistoryQuery recent runs, compare durations, detect regressions

7. Livy Session Health

TaskReferenceNotes
Session Health Assessmentsession-health.md § Livy Session LifecycleSession states, transitions, expected durations
Idle and Zombie Session Detectionsession-health.md § Idle and Zombie Session DetectionFind and clean up leaked sessions
Session Resource Monitoringsession-health.md § Session Resource MonitoringMemory and executor usage via Livy
Session Recovery Patternssession-health.md § Session Recovery PatternsRestart strategies and session replacement

8. Performance Diagnostics

TaskReferenceNotes
Performance Anti-Patternsperformance-patterns.md § Anti-PatternsSpill, shuffle, skew, small files, collect misuse
Stage and Task Analysisperformance-patterns.md § Stage and Task AnalysisReading Spark UI metrics via REST
Optimization Recipesperformance-patterns.md § Optimization RecipesPartition tuning, broadcast joins, caching
Capacity and Resource Diagnosticsperformance-patterns.md § Capacity and Resource DiagnosticsCU consumption, throttling detection

9. Offline / Deep-Dive Tools

TaskReferenceNotes
JobInsight Event Log Copyjobinsight-api.md § LogUtils.copyEventLogCopy event logs from Fabric to OneLake for offline analysis
Local Spark History Serverspark-history-server.md § OverviewStart local SHS for full Spark UI (DAG, tasks, SQL plans)

Must/Prefer/Avoid

MUST DO

  • Always retrieve job/session status before attempting remediation
  • Use workspace and item discovery from COMMON-CLI.md — never hardcode IDs
  • Check Livy session state before submitting diagnostic statements
  • Follow the Failure Triage Workflow for systematic diagnosis
  • Always check the Spark Advisor API before reading raw logs — it often identifies the root cause immediately
  • Use monitoring APIs (no active session required) before attempting Livy-based diagnostics
  • Poll job/session status with 10–30 second intervals; timeout diagnostics after 30 minutes
  • Always include the Notebook Snapshot URL in diagnostic output — it has the longest retention and enables cell-level inspection in the Fabric UI

PREFER

  • Querying job instance history to establish baseline before declaring a regression

  • Reusing existing idle sessions for diagnostic queries instead of creating new ones

  • Checking capacity utilization when jobs are slow before blaming the Spark code

  • Using az rest with JMESPath filtering to extract specific fields from large API responses

  • The Spark Advisor API over manual log parsing for skew, task errors, and timeout detection

  • Resource Usage API coreEfficiency metric to quantify cluster utilization before recommending scaling

  • Job instance history comparison (last 5 runs) to detect regressions before deep-diving

  • For MLV refresh scheduling, monitoring, or run-history, use mlv-operations-cli. For diagnosing the underlying Spark job failure (OOM, skew, shuffle spill), continue with this skill — MLV refreshes execute as Spark jobs and their logs are accessible via the same monitoring APIs.

  • MLV failure classification — when diagnosing a failed MLV refresh, classify the error before deep-diving:

    Error PatternCategoryDiagnosis Path
    MLV_SPARK_SESSION_REQUEST_SUBMISSION_FAILEDInfrastructureCapacity paused/unavailable, Spark pool misconfigured. Check capacity state first.
    MLV_SELECTED_NOT_FOUNDConfigurationMLV table was deleted/renamed. Verify table exists via SHOW MATERIALIZED LAKE VIEWS IN schema.
    OutOfMemoryError / SparkOutOfMemoryResourceSource data grew beyond cluster capacity. Check Spark Advisor for memory pressure.
    ShuffleBlockFetchFailed / data skewPerformanceUneven data distribution. Use Resource Usage API to identify skewed partitions.
    DeltaTableVersionNotFoundDependencySource table was vacuumed below retention threshold. Extend delta.logRetentionDuration.
    ConstraintViolationException / ON MISMATCHData QualityDQ constraint dropped/failed rows. Check source data quality upstream.
    Timeout (run > 24 hours)ScaleLineage too large for single run. Split into smaller lineage groups across lakehouses.

AVOID

  • Killing sessions without checking if they have active statements
  • Creating new sessions for every diagnostic query (reuse idle sessions)
  • Assuming OOM without checking actual memory metrics from Livy
  • Hardcoded workspace or item IDs in diagnostic scripts
  • Diagnosing performance without first checking capacity throttling via the Admin API
  • Submitting diagnostic statements to sessions in busy state

Examples

Example 1: Diagnose a Failed Notebook

User prompt: "Why did my notebook ETL_Daily fail in workspace Production?"

Agent workflow:

  1. Resolves workspace → workspaceId, item → itemId (Notebook)
  2. Lists recent Livy sessions, auto-picks the Failed session
  3. Queries Spark Advisor → finds TaskError: OutOfMemoryError on executor
  4. Queries /stages → confirms data skew (12× max/median ratio in stage 5)
  5. Presents report with HIGH findings + fix recommendations

Example 2: Triage Stuck Livy Session

User prompt: "My Livy session abc-1234 is stuck in starting state"

Agent workflow:

  1. Uses session ID directly, queries session state
  2. Lists all workspace sessions → detects 8 concurrent sessions (capacity pressure)
  3. Checks Livy log → no errors, just queued
  4. Reports: capacity contention, recommends waiting or cancelling idle sessions

Example 3: Pipeline Failure Root Cause

User prompt: "Diagnose pipeline run 5678 in workspace Analytics"

Agent workflow:

  1. Resolves pipeline, calls queryActivityRuns for run 5678
  2. Finds 2 Notebook activities: one Succeeded, one Failed
  3. Extracts output.result.error.{ename, evalue, traceback} from failed activity
  4. Constructs Notebook Snapshot URL for cell-level inspection
  5. Presents error details + snapshot link + suggested fix

Automated Diagnostic Workflow

When the user provides a simple prompt (e.g., "Diagnose my notebook ETL_Pipeline", "What's wrong with Spark application abc-123", "Check workspace Production for issues"), follow this fast-path summary. For full procedure, edge cases (expired data, pipeline-only sessions), report templates, and retention details, see references/automated-diagnostic-workflow.md.

Entry Points (what the user provides)

User providesAgent resolves
Workspace nameworkspaceId (via workspace list + name filter)
Notebook / SJD / Lakehouse nameitemId (via item list + name/type filter)
Pipeline name + run ID→ child Spark activities → see pipeline-diagnosis.md
Livy session ID or Spark app ID→ Use directly
Nothing specific→ Ask for workspace name + item name

Item-Type API Paths

Item TypeLivy Sessions PathJob Instances Path
Notebook/notebooks/{id}/livySessions/items/{id}/jobs/instances
Spark Job Definition/sparkJobDefinitions/{id}/livySessions/items/{id}/jobs/instances
Lakehouse/lakehouses/{id}/livySessions/lakehouses/{id}/jobs/instances

All session API paths follow: $FABRIC_API_URL/workspaces/$workspaceId/<itemTypePath>/$itemId/livySessions/$livyId/applications/$appId/<endpoint> — see SPARK-MONITORING-CORE.md.

Steps at a Glance

StepWhenActionAuto-flag rule
1. Resolve & DiscoverAlwaysResolve workspace → item → list recent Livy sessions; auto-pick if unambiguous, else prompt user
1b. FallbackSession 404 / Spark Monitoring data expiredTry queryActivityRuns (pipeline) → Job Instance failureReason → construct Notebook Snapshot URLSee reference § Step 1b
2. Route by stateAfter Step 1Failed → 3+4+5 · Succeeded/InProgress → 4+5 · Cancelled → log+3 · idle/busy/starting → 6 · dead/killed/error → 3+6
3. Failure analysisFailed / Cancelled / deadQuery in order: Spark Advisor → driver stderr → Job Instance → executor logs → Livy log → Resource Usage. Stop when root cause clear.Match against job-diagnostics.md § Quick Reference Table
4. PerformanceAlways (except 1b path)/stages, /allexecutorsskew max/median > 3× · spill diskBytesSpilled > 0 · GC jvmGcTime/executorRunTime > 20% · shuffle > 1 GB · tasks < 100ms
5. Resource utilizationAlways (except 1b path)/resourceUsagecoreEfficiency < 0.3 → HIGH · idleTime/duration > 0.4 → MEDIUM
6. Session healthIdle/zombie checksGET /workspaces/$workspaceId/spark/livySessionsidle + no recent statements → zombie · starting beyond expected → capacity
7. Compile reportFinalSeverity-ordered findings table + Notebook Snapshot link + suggested fixesSee reference § Step 7 for template

Key principle: Always check Spark Advisor first — it's pre-computed and identifies most root causes without log parsing. Pipeline runs have the richest error data via queryActivityRuns (ename, evalue, traceback, cell/line) — see pipeline-diagnosis.md.

Data retention warning: Spark Monitoring API data (logs, stages, advisor) typically expires in minutes to hours after session end. Diagnose failures promptly. If APIs return 404, jump to Step 1b in the reference.

Tier 2 escalation: For truncated data, HTTP 408/504, or DAG/SQL plan visualization, suggest the offline Spark History Server workflow.