CDN Abnormal Status Code Analysis
Overview
This skill diagnoses abnormal HTTP status codes (4xx / 5xx) on a Huawei Cloud CDN accelerated domain.
It is read-only end to end: every action is a query (GET statistics / GET config / GET log-download-link / read-only log fetch).
It answers four questions for any 4xx/5xx anomaly:
- Is there an anomaly, and how big? — quantify 4xx/5xx volume and ratio over a window.
- Which exact code, when, edge or origin? — drill to the specific code + time bucket, and fork edge-generated vs origin-generated via the back-to-source (
bs_*) status statistics.
- Who / where / what path? — top IPs/paths/UA/referer, client IP count (刷量 vs real users).
- Root cause + forensics? — narrow to edge-config rules or origin-side issues, then pin the exact requests via access logs.
Key Features:
- Edge-vs-origin fork driven by one command (
bs_status_code_*): result={} ⇒ edge-generated; non-empty ⇒ origin-generated.
- Covers the full 4xx/5xx set: 400/401/403/404/405/406/408/410/412/416/429/499/495/496/500/501/502/503/504/505/530….
- Read-only log helper
scripts/fetch_cdn_log.py downloads + decompresses a CDN log and extracts the abnormal-status rows as JSON.
- Structured diagnosis report with a status-code → root-cause decision tree and console/工单 remediation boundary (no CLI write ops).
Tools: hcloud CLI (KooCLI) + Python log helper (scripts/fetch_cdn_log.py).
Core Principle: Read-only diagnosis; no configuration changes.
⛔ Prohibited Operations (Security Constraints)
This skill strictly prohibits all non-GET (write/modify/delete) CDN operations, even if requested by the user.
Total: 55 prohibited operations (24 POST + 25 PUT + 6 DELETE).
For the complete list of all 55 prohibited non-GET operations with risk descriptions, see references/prohibited-operations.md.
Representative prohibited operations (full list in the reference doc):
| Prohibited Operation | Example CLI | Reason |
|---|
| ❌ Create domain | CreateDomain (v1/v2), CreateDomainByDuplicate | Write op, creates production resource |
| ❌ Delete domain | DeleteDomain (v1/v2) | Irreversible |
| ❌ Modify domain config | hcloud CDN UpdateDomainFullConfig / UpdateBlackWhiteList / UpdateRefer / UpdateResponseHeader / UpdateOriginHost / UpdateCacheRules / UpdateHttpsInfo | Write op, affects production traffic |
| ❌ Enable / disable domain | EnableDomain (v1/v2), DisableDomain (v1/v2) | Write op, affects production traffic |
| ❌ Refresh / preheat | hcloud CDN CreateRefreshTasks / CreatePreheatingTasks | Write op, changes cache |
| ❌ Modify billing mode | SetChargeModes | Financial impact |
| ❌ Verify domain owner | hcloud CDN VerifyDomainOwner | Write op |
| ❌ Set stats config / export open | SetStatsConfig / ExportStatsOpen | Write op |
If the user requests a prohibited operation, refuse and inform:
"Per security constraints, this skill performs read-only diagnosis only and does not run any write/delete operations.
To change CDN configuration, use the Huawei Cloud CDN console or run the relevant hcloud command manually — this skill will not execute it.
The complete list of 55 prohibited operations is documented in references/prohibited-operations.md."
Architecture
CDN Abnormal Status Code Analysis (read-only)
├── ListDomains/v2 (target domain → domain_id)
├── ShowDomainStats/v2
│ ├── summary http_code_2xx..5xx + req_num → quantify 4xx/5xx volume + ratio
│ └── detail status_code_4xx/5xx → exact code + time array
├── ShowDomainStats/v2 bs_status_code_4xx/5xx → ★ edge vs origin fork ★
├── ShowBandwidthCalc / ListDomainClientStats → traffic-spike / 刷量 correlation
├── Top-N family → who / where / what path
├── Root cause fork
│ ├── origin side: ShowOriginHost / ShowDomainDetail / ShowHistoryTasks / TopOriginUrl
│ └── edge side: ShowDomainFullConfig / ShowRefer / ShowBlackWhiteList /
│ ListRuleDetails / ListBanUrl / ListAccessControlTask /
│ ShowResponseHeader / ShowCertificatesHttpsInfo
├── ShowLogs/v2 + python scripts/fetch_cdn_log.py → per-request forensics (JSON)
├── ShowIpInfo/v2 → client/edge IP attribution
└── generate diagnosis report
API Call Budget
| Step | API / Script | Rate Limit | Est. Time |
|---|
| 1 | hcloud CDN ListDomains/v2 --cli-region={region} | — | <2s |
| 2 | hcloud CDN ShowDomainStats/v2 --cli-region={region} (summary + detail + bs) | 5/s | <3s |
| 3 | Top-N family + ListDomainClientStats | 2-5/s | <5s |
| 4 | hcloud CDN ShowDomainFullConfig/v2 --cli-region={region} + Show* config | — | <5s |
| 5 | hcloud CDN ShowLogs/v2 --cli-region={region} + python scripts/fetch_cdn_log.py | — | ≤ 30s |
Total estimated time: < 45 seconds (log-heavy window may be longer).
hcloud CDN --cli-region= [--key=value ...]
- Service name:
CDN (uppercase). Operation name: PascalCase (e.g., ShowDomainStats/v2).
- Region parameter:
--cli-region=. CDN supports cn-north-1 (Beijing) and ap-southeast-1 (Singapore); results are region-independent.
Recommended: cn-north-1 uniformly. (cn-north-4 is NOT supported by CDN.)
- Parameter format:
--key=value (equals sign, no spaces). Space-separated form is unsupported.
- Output: append
--cli-output=json for machine parsing.
Prerequisites
Pre-check: hcloud (KooCLI) >= 3.2.0 — hcloud version. If missing, see references/cli-installation-guide.md.
Pre-check: Python >= 3.8 — python --version. Required by scripts/fetch_cdn_log.py.
Pre-check: Python requests >= 2.25 — python -c "import requests; print('ok')". The log helper downloads via requests.
Install if missing: pip install requests>=2.25
Pre-check: hcloud credentials — hcloud configure list. If invalid, stop and guide secure configuration. Never read/echo/print AK/SK; never ask the user to paste AK/SK in chat.
⚠️ hcloud parameter format: all params must use --key=value.
⚠️ CDN region: use cn-north-1 uniformly (CDN does not support cn-north-4).
⚠️ Time / interval rules: time = ms timestamp, [start,end) left-closed right-open;
interval=300 (≤2d, 5-min points) / 3600 (≤7d, hour points) / 86400 (≤31d, CST 0:00 points).
status_code_* (edge) and bs_status_code_* (origin) cannot be mixed in one query.
Authentication
- Prohibited: reading/echoing/printing AK/SK; asking users to input AK/SK in chat;
hcloud configure set with plaintext; accepting AK/SK pasted by the user.
- Allowed: read credentials from environment variables or the active CLI profile only.
- If the user pastes AK/SK, stop, refuse, and emit the secure setup template (
export HUAWEICLOUD_SDK_AK=... / HUAWEICLOUD_SDK_SK=...), then wait.
- Verify:
hcloud configure list — confirm a valid profile exists; if not, stop.
IAM Permission Policies
See references/iam-policies.md. Minimum: read-only CDN query scope (cdn:domain:get + statistics/log query).
The simplest grant is the system read-only policy CDN Domain Viewer ("Allow Query Domains"). No write permissions are required or included.
Core Commands
| Command | Purpose | Key Parameters |
|---|
hcloud configure list | Check credentials | none |
hcloud CDN ListDomains/v2 --cli-region= | List domains → domain_id | — |
hcloud CDN ShowDomainStats/v2 --cli-region= --action=summary|detail --domain_name= --stat_type= --start_time= --end_time= --interval= | Quantify / localize status codes | --action, --stat_type, --interval |
hcloud CDN ShowBandwidthCalc --cli-region= --domain_name= --calc_type=bw_peak --start_time= --end_time= | Bandwidth peak (traffic-spike correlation) | --calc_type |
hcloud CDN ListDomainClientStats --cli-region= --domain_name= --stat_type=ip_num --start_time= --end_time= | Client IP count (刷量 vs real users) | --stat_type=ip_num |
hcloud CDN ListCdnDomainTopIps --cli-region= --domain_name= --stat_type=req_num --start_time= --end_time= | Top-N drill (TopIps; same form for Path/OriginUrl/Refers/Uas; req_num only, no status) | --stat_type=req_num |
hcloud CDN ShowDomainFullConfig/v2 --cli-region= --domain_name= | Full edge config (auth/refer/ip_filter/ua/…) | — |
hcloud CDN ShowRefer --cli-region= --domain_id= | Referer防盗链 config | --domain_id |
hcloud CDN ShowBlackWhiteList --cli-region= --domain_id= | IP blacklist/whitelist | --domain_id |
hcloud CDN ListRuleDetails --cli-region= --domain_name= | Rule engine block rules | — |
hcloud CDN ListBanUrl --cli-region= --start_time= --end_time= --page_number=1 --page_size=50 | Banned URLs (may need工单 whitelist) | time range |
hcloud CDN ListAccessControlTask --cli-region= --start_time= --end_time= --limit=100 | Ban/unban tasks (may need工单 whitelist) | time range |
hcloud CDN ShowOriginHost --cli-region= --domain_id= | 回源HOST | --domain_id |
hcloud CDN ShowResponseHeader --cli-region= --domain_id= | Response header / error-page config | --domain_id |
hcloud CDN ShowDomainDetail --cli-region= --domain_id= | Domain detail (origin/status/CNAME) | --domain_id |
hcloud CDN ShowHistoryTasks/v2 --cli-region= --file_type=file --page_number=1 --page_size=50 | Refresh/preheat history | — |
hcloud CDN ShowCertificatesHttpsInfo/v2 --cli-region= --domain_name= | HTTPS cert (49x/TLS) | --domain_name |
hcloud CDN ShowLogs/v2 --cli-region= --domain_name= --start_time= --end_time= --page_size=100 | Log download links (single domain, ≤30 days) | --domain_name |
python scripts/fetch_cdn_log.py --url [--status 403,502,503,504] [--timeout 30] [--max-lines 200] | Fetch+decompress log, extract abnormal rows (emits JSON) | --url, --status |
hcloud CDN ShowIpInfo/v2 --cli-region= --ips=, | IP attribution (≤20) | --ips |
Top-N family stat_type supports only flux/req_num (no status code) — cross-reference with ShowDomainStats/logs.
Parameter Confirmation
| Parameter | Required | Description | Default | Example |
|---|
domain_name | Yes | CDN accelerated domain to diagnose | — | www.example.com |
domain_id | Yes (for some Show* by-id ops) | From ListDomains/v2 | — | d3aaa521… |
--cli-region | Yes | CDN region | cn-north-1 | cn-north-1 |
| time window | Yes | [start,end) ms timestamps, aligned to interval points | — | last 7 days |
--status (log helper) | No | Status codes to extract | 403,404,499,500,502,503,504,530 | 403,502 |
User confirmation checklist:
Core Workflows
Step 1: Discovery & Quantification — find 4xx/5xx, size, traffic correlation
📄 Detailed steps → references/task-discovery.md
Step 2: Localize & Fork — exact code + time + edge/origin
📄 Detailed steps → references/task-localize.md
Step 3: Distribution — top-N + client-IP count
📄 Detailed steps → references/task-distribution.md
Step 4: Root Cause — origin side (4A) / edge side (4B) per Step 2 fork
📄 Detailed steps → references/task-rootcause.md
Step 5: Per-request Forensics — log fetch + IP attribution
📄 Detailed steps → references/task-forensics.md
📄 Detailed steps → references/task-report.md
References
| Document | Description |
|---|
| task-discovery.md | Step 1: discovery & quantification |
| task-localize.md | Step 2: localize exact code + edge/origin fork |
| task-distribution.md | Step 3: top-N/client distribution |
| task-rootcause.md | Step 4: origin-side (4A) / edge-side (4B) root cause |
| task-forensics.md | Step 5: per-request log forensics |
| task-report.md | Step 6: diagnosis report + decision tree |
| prohibited-operations.md | All 55 prohibited non-GET operations (POST/PUT/DELETE) |
| dataflow-diagram.md | Mermaid data flow diagram |
| related-apis.md | API/CLI reference + stat_type + status-code map |
| iam-policies.md | IAM least-privilege policies |
| verification-method.md | Verification method |
| acceptance-criteria.md | Acceptance criteria checklist |
| troubleshooting.md | Troubleshooting |
| cli-installation-guide.md | CLI installation guide |