-- Read-only diagnostics for sizing and partition verification.
SET time_zone = '+00:00';

SELECT
    TABLE_NAME,
    ENGINE,
    TABLE_ROWS,
    ROUND(DATA_LENGTH / 1024 / 1024, 1) AS data_mb,
    ROUND(INDEX_LENGTH / 1024 / 1024, 1) AS index_mb,
    ROUND((DATA_LENGTH + INDEX_LENGTH) / 1024 / 1024, 1) AS total_mb
FROM information_schema.TABLES
WHERE TABLE_SCHEMA = DATABASE()
ORDER BY (DATA_LENGTH + INDEX_LENGTH) DESC;

SELECT
    TABLE_NAME,
    COUNT(*) AS partitions,
    MIN(PARTITION_NAME) AS oldest_partition,
    MAX(PARTITION_NAME) AS newest_partition,
    ROUND(SUM(DATA_LENGTH + INDEX_LENGTH) / 1024 / 1024, 1) AS total_mb
FROM information_schema.PARTITIONS
WHERE TABLE_SCHEMA = DATABASE()
  AND PARTITION_NAME IS NOT NULL
GROUP BY TABLE_NAME
ORDER BY total_mb DESC;

SELECT
    channel_name,
    event_id,
    SUM(cnt) AS events_24h,
    COUNT(*) AS metadata_rows_24h,
    ROUND(SUM(cnt) / NULLIF(COUNT(*), 0), 2) AS compression_factor
FROM event_occurrences
WHERE bucket_start >= UTC_TIMESTAMP() - INTERVAL 24 HOUR
GROUP BY channel_name, event_id
ORDER BY events_24h DESC
LIMIT 50;

SELECT
    first_event_ts,
    last_event_ts,
    cnt,
    hostname,
    target_user,
    workstation,
    src_ip
FROM event_occurrences
WHERE channel_name = 'Security'
  AND event_id = 4740
  AND bucket_start >= UTC_TIMESTAMP() - INTERVAL 7 DAY
ORDER BY bucket_start DESC
LIMIT 200;