fix(mpstat): Busy-CPU default-aggregation should be "sum", not "avg"

[atheurer]

Bug

sysstat-post-process.py sets a single default-aggregation: avg for all mpstat metrics at line 332:

desc = {"class": "percentage", "source": "mpstat", "default-aggregation": "avg"}

This descriptor is reused for both Busy-CPU and NonBusy-CPU. For Busy-CPU, the underlying data is stored as one sample per CPU type (usr, sys, soft, irq, nice, guest, steal — one names entry per type). When a CDM query requests Busy-CPU broken out by CPU number but not by type, the API must aggregate across the types. With avg it returns the average of the individual type values (~25% when four types each contribute ~25%) instead of the correct total utilization.

Observed impact

Querying mpstat::Busy-CPU with breakout=["hostname", "num=195"] returned 24.8% for a CPU that was in fact 99.3% busy. The error was diagnosed by adding type to the breakout (which bypasses aggregation) and confirmed by overriding the aggregation method to sum via the CDM API, which returned the correct 99.3%.

Root cause

The CPU type fields (usr, sys, soft, irq, …) are mutually exclusive time slices of a single CPU's total time — they sum to the total CPU utilization by definition. The correct aggregation when collapsing across types is sum, not avg.

Fix

Change the aggregation per metric type inside the loop rather than relying on a single top-level default:

if cpu_type in ("idle", "iowait", "steal"):
    desc["type"] = "NonBusy-CPU"
    desc["default-aggregation"] = "avg"
else:
    desc["type"] = "Busy-CPU"
    desc["default-aggregation"] = "sum"

Or more simply, set default-aggregation: sum for Busy-CPU at the point it is assigned.

CDM skill note

Until this is fixed, queries against mpstat::Busy-CPU must either:

• Include type in the breakout to get per-type values (then sum manually), or
• Pass "aggregation": "sum" as an override in the CDM API request

The skills/crucible/cdm-query-guide.md skill should be updated to document this workaround.

[atheurer]

Update: the class field also needs to change, not just default-aggregation.

Busy-CPU and NonBusy-CPU should both be class: "throughput" (matching the pattern used by sar-net's L2-Gbps/packets-sec/errors-sec, which already correctly use class: "throughput" + default-aggregation: "sum"). Once collapsed via sum across the mutually-exclusive type breakout, the result is a rate/total (e.g. "195% busy" across 2 CPUs), not a single bounded 0-100 percentage — so class: "percentage" is the wrong semantic label post-aggregation.

Revised fix for both mpstat and pidstat (see companion issue for pidstat):

if cpu_type in ("idle", "iowait", "steal"):
    desc["type"] = "NonBusy-CPU"
else:
    desc["type"] = "Busy-CPU"
desc["class"] = "throughput"
desc["default-aggregation"] = "sum"

This applies to both Busy-CPU and NonBusy-CPU — idle/iowait/steal are just as mutually-exclusive a set of time slices as usr/sys/soft/irq/nice/guest/steal, so NonBusy-CPU has the identical bug, just not yet observed in the wild.