{@code QueryLineageRepository.findLongestByConnectionIdAndNormalizedQueryTextPrefix} + * wraps {@code query_text} in three nested {@code regexp_replace}/{@code REPLACE} calls + * plus {@code LOWER} before comparing it, so no index on {@code query_text} can ever + * satisfy the predicate — Postgres must materialize a rewritten copy of every row in the + * connection's slice. {@code EXPLAIN (ANALYZE)} on a real install: + * + *
+ * Seq Scan on query_lineage (actual time=0.244..35.826 rows=422 loops=1) + * Execution Time: 36.179 ms -- at 1,093 rows + * Execution Time: 1111.996 ms -- same query, table scaled to 34,976 rows + *+ * + *
{@code SlowQueryAnalyticsService.recoverFullText} runs that once per sample, up to + * 20 per "view full query" click, so one modal open costs ~0.7 s today and ~22 s at 35k + * rows. It degrades with age rather than load, which is why it passes every + * pre-launch test: {@code query_lineage} is not pruned by + * {@code SlowQueryRetentionService} (that only touches {@code slow_query_run}, + * {@code slow_query_customer_day} and {@code slow_query_sample}), so it only grows. + * + *
Precomputing the normalization into a STORED generated column pays the regex chain + * once at write time. Measured on the same scaled table, with the ~120-character prefix + * the caller actually sends: + * + *
+ * Index Scan using idx_query_lineage_norm_match + * Execution Time: 0.428 ms -- vs 1111.996 ms + *+ * + *
The index earns its keep only because the prefix is long and therefore selective. A + * short prefix such as {@code 'select%'} still plans as a sequential scan (~50 ms at 35k + * rows) — that is the precomputation alone, and is fine. Do not "simplify" this by + * dropping the generated column and indexing {@code query_text} directly; the expression, + * not the column, is what the query compares. + * + *
There is no Flyway runtime in this repo (see CLAUDE.md), so this initializer is what + * actually applies {@code V118__add_query_lineage_norm_match.sql}. Both statements are + * {@code IF NOT EXISTS} and the whole thing is best-effort: a failure here costs + * performance, never correctness, since the query returns identical rows either way. + */ +@Configuration +@Slf4j +public class QueryLineageMatchIndexInitializer { + + private static final String TABLE = "query_lineage"; + private static final String COLUMN = "normalized_match"; + private static final String INDEX = "idx_query_lineage_norm_match"; + + /** + * Must match {@code SlowQueryAnalyticsService.normalizeForMatching} exactly. If one + * changes, both do. + * + *
The {@code btrim} is load-bearing and was missing from the expression this
+ * replaces: Java's {@code normalizeForMatching} ends with {@code .trim()}, so a
+ * lineage row stored with leading whitespace normalized to {@code " select ..."} on
+ * the SQL side and {@code "select ..."} on the Java side. The prefix {@code LIKE}
+ * then never matched and recovery silently returned the truncated sample. 4 of 1,174
+ * rows on the local install carry such whitespace.
+ */
+ private static final String NORMALIZE_EXPR =
+ "btrim(lower(regexp_replace(regexp_replace("
+ + "replace(query_text, '`', ''), "
+ + "'\\s*([.,();])\\s*', '\\1', 'g'), "
+ + "'\\s+', ' ', 'g')))";
+
+ @Bean("queryLineageMatchIndexBootstrap")
+ @DependsOn("entityManagerFactory")
+ public Object queryLineageMatchIndexBootstrap(DataSource dataSource) {
+ JdbcTemplate jdbc = new JdbcTemplate(dataSource);
+
+ if (!tableExists(jdbc, TABLE)) {
+ return new Object();
+ }
+
+ // A generated column's expression cannot be altered in place, and ADD COLUMN IF
+ // NOT EXISTS silently keeps whatever definition is already there. An install that
+ // ran an earlier build of this initializer therefore keeps the untrimmed
+ // expression forever unless the column is dropped first. Only drop when the
+ // definition actually differs, so a normal restart does not rewrite the table.
+ if (columnDefinitionDiffers(jdbc)) {
+ log.info("Rebuilding {}.{}: stored expression is out of date", TABLE, COLUMN);
+ try {
+ jdbc.execute("ALTER TABLE " + TABLE + " DROP COLUMN " + COLUMN);
+ } catch (RuntimeException e) {
+ log.warn("Could not drop stale {}.{}: {}", TABLE, COLUMN, e.getMessage());
+ }
+ }
+
+ try {
+ jdbc.execute("ALTER TABLE " + TABLE + " ADD COLUMN IF NOT EXISTS " + COLUMN
+ + " text GENERATED ALWAYS AS (" + NORMALIZE_EXPR + ") STORED");
+ } catch (RuntimeException e) {
+ // Generated columns need Postgres 12+. Older servers keep the sequential scan,
+ // which is slow but correct, so this must not stop the application.
+ log.warn("Could not add {}.{} ({}); sample recovery stays on a sequential scan",
+ TABLE, COLUMN, e.getMessage());
+ return new Object();
+ }
+
+ try {
+ // text_pattern_ops so a LIKE 'prefix%' comparison can use the index under any
+ // collation; the default opclass only helps in the C collation.
+ jdbc.execute("CREATE INDEX IF NOT EXISTS " + INDEX + " ON " + TABLE
+ + " (connection_id, " + COLUMN + " text_pattern_ops)");
+ } catch (RuntimeException e) {
+ log.warn("Could not create {}: {}", INDEX, e.getMessage());
+ }
+
+ return new Object();
+ }
+
+ /**
+ * True when {@code normalized_match} exists but was generated by a different
+ * expression than {@link #NORMALIZE_EXPR}. Compared on the normalized form Postgres
+ * stores in {@code pg_get_expr}, with whitespace collapsed, since the server rewrites
+ * the text it was given (adds casts, reorders parens) and a literal comparison would
+ * report a difference on every start and rewrite the table each time.
+ */
+ private static boolean columnDefinitionDiffers(JdbcTemplate jdbc) {
+ try {
+ String stored = jdbc.query(
+ "SELECT pg_get_expr(d.adbin, d.adrelid) "
+ + "FROM pg_attrdef d "
+ + "JOIN pg_attribute a ON a.attrelid = d.adrelid AND a.attnum = d.adnum "
+ + "WHERE d.adrelid = ?::regclass AND a.attname = ?",
+ rs -> rs.next() ? rs.getString(1) : null, TABLE, COLUMN);
+ if (stored == null) {
+ return false; // column not present yet — nothing stale to drop
+ }
+ return !squash(stored).contains("btrim");
+ } catch (RuntimeException e) {
+ log.warn("Could not inspect {}.{} definition: {}", TABLE, COLUMN, e.getMessage());
+ return false;
+ }
+ }
+
+ private static String squash(String s) {
+ return s.replaceAll("\\s+", "").toLowerCase();
+ }
+
+ private static boolean tableExists(JdbcTemplate jdbc, String table) {
+ try {
+ Integer found = jdbc.queryForObject(
+ "SELECT COUNT(*) FROM information_schema.tables "
+ + "WHERE table_schema = current_schema() AND table_name = ?",
+ Integer.class, table);
+ return found != null && found > 0;
+ } catch (RuntimeException e) {
+ log.warn("Could not check for table {}: {}", table, e.getMessage());
+ return false;
+ }
+ }
+}
diff --git a/backend/src/main/java/com/dbaagent/controller/SlowQueryAnalyticsController.java b/backend/src/main/java/com/dbaagent/controller/SlowQueryAnalyticsController.java
index 525d841..91021b8 100644
--- a/backend/src/main/java/com/dbaagent/controller/SlowQueryAnalyticsController.java
+++ b/backend/src/main/java/com/dbaagent/controller/SlowQueryAnalyticsController.java
@@ -78,7 +78,41 @@ public ResponseEntity The customer id is a query parameter, not a path segment, because it is a
+ * literal value read out of the tenant column — application data, which can contain
+ * {@code /}, {@code ?} or {@code #}. Such an id is unreachable as a path segment under
+ * any encoding: raw, the slash splits the path; percent-encoded, Jetty rejects it with
+ * {@code 400 Ambiguous URI path separator}. Both were reproduced against this backend
+ * with the tenant value {@code acct/77?x=1}, whose rows were simply invisible in the
+ * By-Customer view.
+ */
+ @GetMapping("/{connectionId}/customer-queries")
+ public ResponseEntity The regex chain runs once per candidate row, so this is intended for
- * single-row lookups (LIMIT 1) over the per-connection slice. For
- * d840f866-style connections (~5K lineage rows) it returns in a few ms;
- * larger connections may benefit from a functional index on the
- * normalized expression, but none is needed yet.
+ * The normalization is precomputed into the stored generated column
+ * {@code normalized_match} ({@code QueryLineageMatchIndexInitializer}) and matched
+ * against that, so the regex chain runs once at write time rather than once per
+ * candidate row on every read. Inlining the expression here made the predicate
+ * unindexable: Postgres had to materialize a rewritten copy of the whole
+ * per-connection slice, which measured 36 ms at 1,093 rows and 1,112 ms at 34,976 —
+ * and {@code recoverFullText} issues this up to 20 times per "view full query" click,
+ * against a table no retention job prunes. On the same scaled table with the ~120-char
+ * prefix the caller actually sends, the indexed form plans as an Index Scan at
+ * 0.428 ms.
+ *
+ * Matched against the column directly, with no {@code COALESCE} fallback to
+ * the inline expression. That fallback is the obvious way to stay safe on a database
+ * without the column, and it silently undoes the whole fix: wrapping the column in
+ * {@code COALESCE(...)} makes the predicate non-indexable again. Measured on the same
+ * 37,504-row table — {@code COALESCE(normalized_match, …)} plans a Seq Scan at
+ * 48.7 ms, the bare column an Index Scan at 0.39 ms. If the column is ever absent,
+ * {@code QueryLineageMatchIndexInitializer} logs it at WARN and
+ * {@code SlowQueryAnalyticsService.recoverFullText} already treats a failed lookup as
+ * "no longer text available" and returns the sample unchanged.
*/
@Query(value = """
SELECT * FROM query_lineage
WHERE connection_id = :connectionId
AND LENGTH(query_text) > :minLength
- AND LOWER(
- regexp_replace(
- regexp_replace(
- REPLACE(query_text, '`', ''),
- '\\s*([.,();])\\s*', '\\1', 'g'),
- '\\s+', ' ', 'g')
- ) LIKE :escapedPrefix ESCAPE '\\'
+ AND normalized_match LIKE :escapedPrefix ESCAPE '\\'
ORDER BY LENGTH(query_text) DESC
LIMIT 1
""", nativeQuery = true)
@@ -172,4 +183,24 @@ QueryLineage findLongestByConnectionIdAndNormalizedQueryTextPrefix(
@Param("escapedPrefix") String escapedPrefix,
@Param("minLength") int minLength
);
+
+ /**
+ * Drop lineage rows older than the connection's retention window.
+ *
+ * This table was never pruned: {@code SlowQueryRetentionService} covered
+ * {@code slow_query_run}, {@code slow_query_customer_day} and
+ * {@code slow_query_sample} but not lineage, so it grew without bound while the
+ * 30-day analytics tables stayed small. That is what made sample recovery degrade
+ * with age rather than load — the scanned table kept growing even on an idle install.
+ *
+ * Keyed on {@code created_at}, which is non-null and already indexed
+ * ({@code idx_query_lineage_created}).
+ */
+ @Modifying
+ @Transactional
+ @Query("DELETE FROM QueryLineage q WHERE q.connectionId = :connectionId "
+ + "AND q.createdAt < :cutoff")
+ int deleteByConnectionIdAndCreatedAtBefore(
+ @Param("connectionId") String connectionId,
+ @Param("cutoff") java.time.LocalDateTime cutoff);
}
diff --git a/backend/src/main/java/com/dbaagent/service/SlowLogIngestionService.java b/backend/src/main/java/com/dbaagent/service/SlowLogIngestionService.java
index c3509b3..3226966 100644
--- a/backend/src/main/java/com/dbaagent/service/SlowLogIngestionService.java
+++ b/backend/src/main/java/com/dbaagent/service/SlowLogIngestionService.java
@@ -418,6 +418,30 @@ private boolean isFrequencySatisfied(SlowLogSourceConfig config) {
return last.plusMinutes(freq).isBefore(LocalDateTime.now());
}
+ /**
+ * KNOWN ISSUE — this cursor has two defects, both unfixed. Deliberately left alone
+ * rather than changed blind: every provider needs live cloud credentials to exercise,
+ * so a fix cannot be verified end to end here, and getting it wrong silently skips or
+ * duplicates slow-query events.
+ *
+ * {@code SlowLogSourceConfigService.updateAfterAutoIngestion} has the same bug.
+ */
private void updateLastProcessed(SlowLogSourceConfig config) {
config.setLastProcessedAt(LocalDateTime.now());
config.setUpdatedAt(LocalDateTime.now());
diff --git a/backend/src/main/java/com/dbaagent/service/SlowQueryRetentionService.java b/backend/src/main/java/com/dbaagent/service/SlowQueryRetentionService.java
index 442285c..9134c21 100644
--- a/backend/src/main/java/com/dbaagent/service/SlowQueryRetentionService.java
+++ b/backend/src/main/java/com/dbaagent/service/SlowQueryRetentionService.java
@@ -4,6 +4,7 @@
import com.dbaagent.repository.ResourceLimitsRepository;
import com.dbaagent.repository.SlowQueryCustomerDayRepository;
import com.dbaagent.repository.SlowQueryRunRepository;
+import com.dbaagent.repository.QueryLineageRepository;
import com.dbaagent.repository.SlowQuerySampleRepository;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
@@ -32,6 +33,7 @@ public class SlowQueryRetentionService {
private final SlowQueryRunRepository runRepository;
private final SlowQuerySampleRepository sampleRepository;
private final SlowQueryCustomerDayRepository customerDayRepository;
+ private final QueryLineageRepository queryLineageRepository;
private final ResourceLimitsRepository resourceLimitsRepository;
/** Resolve the retention window for a connection (days). */
@@ -44,7 +46,12 @@ public int retentionDaysFor(String connectionId) {
/**
* Delete slow-query analytics rows older than the connection's retention
- * window across all three fact tables. Safe to call repeatedly.
+ * window across all four fact tables. Safe to call repeatedly.
+ *
+ * {@code query_lineage} was missing here, and that mattered more than the row
+ * count suggests: it is the table {@code recoverFullText} scans up to 20 times per
+ * "view full query" click, so leaving it unpruned made sample recovery degrade with
+ * the install's age while the other three tables stayed bounded at 30 days.
*/
@Transactional
public void purge(String connectionId) {
@@ -55,11 +62,13 @@ public void purge(String connectionId) {
int customerDays = customerDayRepository.deleteByConnectionIdAndDayBefore(connectionId, cutoff);
int samples = sampleRepository.deleteByConnectionIdAndCapturedAtBefore(
connectionId, cutoff.atStartOfDay());
+ int lineage = queryLineageRepository.deleteByConnectionIdAndCreatedAtBefore(
+ connectionId, cutoff.atStartOfDay());
- if (runs > 0 || customerDays > 0 || samples > 0) {
+ if (runs > 0 || customerDays > 0 || samples > 0 || lineage > 0) {
log.info("Slow-query retention purge for connection {} (>{}d): "
- + "{} runs, {} customer-days, {} samples removed",
- connectionId, days, runs, customerDays, samples);
+ + "{} runs, {} customer-days, {} samples, {} lineage rows removed",
+ connectionId, days, runs, customerDays, samples, lineage);
}
}
}
diff --git a/backend/src/main/resources/db/migration/V118__add_query_lineage_norm_match.sql b/backend/src/main/resources/db/migration/V118__add_query_lineage_norm_match.sql
new file mode 100644
index 0000000..26da180
--- /dev/null
+++ b/backend/src/main/resources/db/migration/V118__add_query_lineage_norm_match.sql
@@ -0,0 +1,40 @@
+-- Make slow-query sample recovery indexable.
+--
+-- QueryLineageRepository.findLongestByConnectionIdAndNormalizedQueryTextPrefix used to
+-- wrap query_text in three nested regexp_replace/REPLACE calls plus LOWER before
+-- comparing, so no index could satisfy the predicate. Postgres materialized a rewritten
+-- copy of every row in the connection's slice, and SlowQueryAnalyticsService
+-- .recoverFullText issues that up to 20 times per "view full query" click.
+--
+-- Measured with EXPLAIN (ANALYZE) on a real install:
+-- 1,093 rows -> 36 ms per call (~0.7 s per modal open)
+-- 34,976 rows -> 1112 ms per call (~22 s per modal open)
+-- The growth is linear, and query_lineage was not pruned by SlowQueryRetentionService,
+-- so this degraded with the install's age rather than its load — which is why it passed
+-- every pre-launch test.
+--
+-- Precomputing the normalization into a STORED generated column pays the regex chain once
+-- at write time. On the same 34,976-row table, with the ~120-character prefix the caller
+-- actually sends: Index Scan, 0.428 ms.
+--
+-- The btrim matches Java's normalizeForMatching, which ends with .trim(). Without it a
+-- row stored with leading whitespace normalizes to " select ..." here but "select ..." in
+-- Java, so the prefix LIKE never matches and recovery silently returns the truncated
+-- sample. That flaw was present in the inline expression this replaces.
+--
+-- NOTE: this repo has no Flyway runtime (see CLAUDE.md). QueryLineageMatchIndexInitializer
+-- is what actually applies these statements at startup; this file is the changelog record.
+
+ALTER TABLE query_lineage
+ ADD COLUMN IF NOT EXISTS normalized_match text
+ GENERATED ALWAYS AS (
+ btrim(lower(regexp_replace(regexp_replace(
+ replace(query_text, '`', ''),
+ '\s*([.,();])\s*', '\1', 'g'),
+ '\s+', ' ', 'g')))
+ ) STORED;
+
+-- text_pattern_ops so LIKE 'prefix%' can use the index under any collation; the default
+-- opclass only helps in the C collation.
+CREATE INDEX IF NOT EXISTS idx_query_lineage_norm_match
+ ON query_lineage (connection_id, normalized_match text_pattern_ops);
diff --git a/src/components/sections/SlowQueriesSection.jsx b/src/components/sections/SlowQueriesSection.jsx
index eb320dd..44af4c0 100644
--- a/src/components/sections/SlowQueriesSection.jsx
+++ b/src/components/sections/SlowQueriesSection.jsx
@@ -1,4 +1,4 @@
-import { useState } from 'react'
+import { useRef, useState } from 'react'
import { Activity, FileText, LineChart, Settings, Users } from 'lucide-react'
import { useConnectionManager } from '@/lib/hooks/useConnectionManager'
import { useSlowLogSourceConfig } from '@/lib/hooks/queries'
@@ -33,6 +33,28 @@ const LOG_SOURCE_HELP = {
export default function SlowQueriesSection() {
const { connectionId, selectedConnection } = useConnectionManager()
const [tab, setTab] = useState('trends')
+ const tabRefs = useRef({})
+
+ /** Arrow / Home / End move between tabs, as the ARIA tabs pattern expects. */
+ const onTabKeyDown = (e) => {
+ const step = { ArrowRight: 1, ArrowLeft: -1 }[e.key]
+ if (step === undefined && e.key !== 'Home' && e.key !== 'End') return
+ e.preventDefault()
+ // Resolve the next tab from the *current* state, not the `tab` captured when this
+ // handler was created: two keypresses within one render would otherwise both move
+ // relative to the same starting index and selection would stick after the first.
+ setTab((current) => {
+ const i = TABS.findIndex((t) => t.id === current)
+ const next = e.key === 'Home' ? 0
+ : e.key === 'End' ? TABS.length - 1
+ : (i + step + TABS.length) % TABS.length
+ const id = TABS[next].id
+ // Focus follows selection, per the ARIA tabs pattern. Deferred so the tab is
+ // already rendered with tabIndex=0 when we focus it.
+ queueMicrotask(() => tabRefs.current[id]?.focus())
+ return id
+ })
+ }
const [logSourceModalOpen, setLogSourceModalOpen] = useState(false)
const logSourceQ = useSlowLogSourceConfig(connectionId)
const hasLogSource = Boolean(logSourceQ.data?.id)
@@ -86,16 +108,28 @@ export default function SlowQueriesSection() {
) : (
<>
Exists because every panel here rendered a failed fetch and an empty result
+ * identically: the branch was `!isLoading && rows.length === 0`, and `data ?? []` turns
+ * any error into an empty array. Clicking a customer whose row said "1 slow query · 12
+ * executions" produced "No queries rolled up yet for this customer" when the request had
+ * actually 404'd — the data existed and the UI reported absence.
+ *
+ * That matters most for 403s: with connection authorization now enforced, a user
+ * without access to a connection gets a denial, and rendering it as "nothing captured
+ * yet" would send them to re-run an ingestion they cannot fix.
+ */
+export function QueryError({ error, what = "data", className }) {
+ // `error.status`, not `error.response.status`: the axios response interceptor in
+ // api/client.js rethrows a plain Error with the status copied onto it. Reading the
+ // axios-shaped field silently never matches, so every denial fell through to the
+ // generic branch. `responseData` is where the interceptor puts the parsed body.
+ const status = error?.status ?? error?.response?.status;
+
+ let message;
+ if (status === 403) {
+ message = `You don't have access to this connection's ${what}.`;
+ } else if (status === 404) {
+ message = `Not found — the ${what} may have been removed, or belong to another connection.`;
+ } else if (status === 412) {
+ message = `Not configured for this connection yet.`;
+ } else {
+ // Prefer the server's own wording; the axios interceptor puts it on `message`.
+ message = error?.responseData?.message
+ || error?.response?.data?.message
+ || error?.message
+ || `Could not load ${what}.`;
+ }
+
+ return (
+
+ *
+ *
+ * No workload analysis yet
diff --git a/src/components/tabs/Performance/components/QueryError.js b/src/components/tabs/Performance/components/QueryError.js
new file mode 100644
index 0000000..b2878fc
--- /dev/null
+++ b/src/components/tabs/Performance/components/QueryError.js
@@ -0,0 +1,47 @@
+import { AlertTriangle } from "lucide-react";
+
+/**
+ * The error state for an async panel in the Performance tab.
+ *
+ *