--- name: huawei-cloud-cdn-abnormal-status-code-analysis description: | Diagnose CDN business abnormal HTTP status codes (4xx/5xx) using hcloud CLI. Discover and quantify 4xx/5xx volume, localize the exact status code and time window, fork edge-generated vs origin-generated via back-to-source status statistics, correlate top-N distribution, narrow root cause on CDN edge config or origin side, and取证 per-request access logs. Use this skill when the user wants to: (1) diagnose CDN abnormal 4xx/5xx status codes, (2) root-cause a 403/404/5xx spike on a CDN domain, (3) tell whether abnormal codes are generated by the CDN edge or returned by the origin, (4) troubleshoot CDN business exception status codes during daily inspection or incidents. Triggers include: 状态码异常, 业务异常码, 4xx, 5xx, 403, 404, 502, 503, 504, status code, abnormal status, CDN异常, 边缘/回源, 限流, status code analysis, edge vs origin tags: - cdn - status-code - diagnosis - hcloud - troubleshooting --- # CDN Abnormal Status Code Analysis ## Overview This skill diagnoses **abnormal HTTP status codes (4xx / 5xx)** on a Huawei Cloud CDN accelerated domain. It is **read-only** end to end: every action is a query (GET statistics / GET config / GET log-download-link / read-only log fetch). It answers four questions for any 4xx/5xx anomaly: 1. **Is there an anomaly, and how big?** — quantify 4xx/5xx volume and ratio over a window. 2. **Which exact code, when, edge or origin?** — drill to the specific code + time bucket, and fork **edge-generated vs origin-generated** via the back-to-source (`bs_*`) status statistics. 3. **Who / where / what path?** — top IPs/paths/UA/referer, client IP count (刷量 vs real users). 4. **Root cause + forensics?** — narrow to edge-config rules or origin-side issues, then pin the exact requests via access logs. **Key Features:** - Edge-vs-origin fork driven by one command (`bs_status_code_*`): `result={}` ⇒ edge-generated; non-empty ⇒ origin-generated. - Covers the full 4xx/5xx set: 400/401/403/404/405/406/408/410/412/416/429/499/495/496/500/501/502/503/504/505/530…. - Read-only log helper `scripts/fetch_cdn_log.py` downloads + decompresses a CDN log and extracts the abnormal-status rows as JSON. - Structured diagnosis report with a status-code → root-cause decision tree and console/工单 remediation boundary (no CLI write ops). **Tools**: hcloud CLI (KooCLI) + Python log helper (`scripts/fetch_cdn_log.py`). **Core Principle**: Read-only diagnosis; **no configuration changes**. ## ⛔ Prohibited Operations (Security Constraints) > This skill strictly prohibits **all non-GET (write/modify/delete) CDN operations**, even if requested by the user. **Total: 55 prohibited operations** (24 POST + 25 PUT + 6 DELETE). For the complete list of all 55 prohibited non-GET operations with risk descriptions, see [references/prohibited-operations.md](references/prohibited-operations.md). **Representative prohibited operations (full list in the reference doc):** | Prohibited Operation | Example CLI | Reason | |----------------------|-------------|--------| | ❌ Create domain | `CreateDomain` (v1/v2), `CreateDomainByDuplicate` | Write op, creates production resource | | ❌ Delete domain | `DeleteDomain` (v1/v2) | Irreversible | | ❌ Modify domain config | `hcloud CDN UpdateDomainFullConfig` / `UpdateBlackWhiteList` / `UpdateRefer` / `UpdateResponseHeader` / `UpdateOriginHost` / `UpdateCacheRules` / `UpdateHttpsInfo` | Write op, affects production traffic | | ❌ Enable / disable domain | `EnableDomain` (v1/v2), `DisableDomain` (v1/v2) | Write op, affects production traffic | | ❌ Refresh / preheat | `hcloud CDN CreateRefreshTasks` / `CreatePreheatingTasks` | Write op, changes cache | | ❌ Modify billing mode | `SetChargeModes` | Financial impact | | ❌ Verify domain owner | `hcloud CDN VerifyDomainOwner` | Write op | | ❌ Set stats config / export open | `SetStatsConfig` / `ExportStatsOpen` | Write op | > If the user requests a prohibited operation, refuse and inform: > "Per security constraints, this skill performs read-only diagnosis only and does not run any write/delete operations. > To change CDN configuration, use the Huawei Cloud CDN console or run the relevant hcloud command manually — this skill will not execute it. > The complete list of 55 prohibited operations is documented in references/prohibited-operations.md." ## Architecture ``` CDN Abnormal Status Code Analysis (read-only) ├── ListDomains/v2 (target domain → domain_id) ├── ShowDomainStats/v2 │ ├── summary http_code_2xx..5xx + req_num → quantify 4xx/5xx volume + ratio │ └── detail status_code_4xx/5xx → exact code + time array ├── ShowDomainStats/v2 bs_status_code_4xx/5xx → ★ edge vs origin fork ★ ├── ShowBandwidthCalc / ListDomainClientStats → traffic-spike / 刷量 correlation ├── Top-N family → who / where / what path ├── Root cause fork │ ├── origin side: ShowOriginHost / ShowDomainDetail / ShowHistoryTasks / TopOriginUrl │ └── edge side: ShowDomainFullConfig / ShowRefer / ShowBlackWhiteList / │ ListRuleDetails / ListBanUrl / ListAccessControlTask / │ ShowResponseHeader / ShowCertificatesHttpsInfo ├── ShowLogs/v2 + python scripts/fetch_cdn_log.py → per-request forensics (JSON) ├── ShowIpInfo/v2 → client/edge IP attribution └── generate diagnosis report ``` ### API Call Budget | Step | API / Script | Rate Limit | Est. Time | |------|--------------|-----------|-----------| | 1 | `hcloud CDN ListDomains/v2 --cli-region={region}` | — | <2s | | 2 | `hcloud CDN ShowDomainStats/v2 --cli-region={region}` (summary + detail + bs) | 5/s | <3s | | 3 | Top-N family + `ListDomainClientStats` | 2-5/s | <5s | | 4 | `hcloud CDN ShowDomainFullConfig/v2 --cli-region={region}` + Show* config | — | <5s | | 5 | `hcloud CDN ShowLogs/v2 --cli-region={region}` + `python scripts/fetch_cdn_log.py` | — | ≤ 30s | **Total estimated time**: < 45 seconds (log-heavy window may be longer). ## KooCLI Command Format Standard ```bash hcloud CDN --cli-region= [--key=value ...] ``` - **Service name**: `CDN` (uppercase). Operation name: PascalCase (e.g., `ShowDomainStats/v2`). - **Region parameter**: `--cli-region=`. CDN supports `cn-north-1` (Beijing) and `ap-southeast-1` (Singapore); results are region-independent. **Recommended: `cn-north-1` uniformly.** (`cn-north-4` is NOT supported by CDN.) - **Parameter format**: `--key=value` (equals sign, no spaces). Space-separated form is unsupported. - **Output**: append `--cli-output=json` for machine parsing. ## Prerequisites > **Pre-check: hcloud (KooCLI) >= 3.2.0** — `hcloud version`. If missing, see [references/cli-installation-guide.md](references/cli-installation-guide.md). > **Pre-check: Python >= 3.8** — `python --version`. Required by `scripts/fetch_cdn_log.py`. > **Pre-check: Python `requests >= 2.25`** — `python -c "import requests; print('ok')"`. The log helper downloads via `requests`. > Install if missing: `pip install requests>=2.25` > **Pre-check: hcloud credentials** — `hcloud configure list`. If invalid, stop and guide secure configuration. Never read/echo/print AK/SK; never ask the user to paste AK/SK in chat. > **⚠️ hcloud parameter format**: all params must use `--key=value`. > **⚠️ CDN region**: use `cn-north-1` uniformly (CDN does not support `cn-north-4`). > **⚠️ Time / interval rules**: time = ms timestamp, `[start,end)` left-closed right-open; > `interval=300` (≤2d, 5-min points) / `3600` (≤7d, hour points) / `86400` (≤31d, **CST 0:00 points**). > `status_code_*` (edge) and `bs_status_code_*` (origin) **cannot be mixed in one query**. ## Authentication - **Prohibited**: reading/echoing/printing AK/SK; asking users to input AK/SK in chat; `hcloud configure set` with plaintext; accepting AK/SK pasted by the user. - **Allowed**: read credentials from environment variables or the active CLI profile only. - If the user pastes AK/SK, stop, refuse, and emit the secure setup template (`export HUAWEICLOUD_SDK_AK=...` / `HUAWEICLOUD_SDK_SK=...`), then wait. - Verify: `hcloud configure list` — confirm a valid profile exists; if not, stop. ## IAM Permission Policies See [references/iam-policies.md](references/iam-policies.md). Minimum: read-only CDN query scope (`cdn:domain:get` + statistics/log query). The simplest grant is the system read-only policy **CDN Domain Viewer** ("Allow Query Domains"). No write permissions are required or included. ## Core Commands | Command | Purpose | Key Parameters | |---------|---------|----------------| | `hcloud configure list` | Check credentials | none | | `hcloud CDN ListDomains/v2 --cli-region=` | List domains → domain_id | — | | `hcloud CDN ShowDomainStats/v2 --cli-region= --action=summary\|detail --domain_name= --stat_type= --start_time= --end_time= --interval=` | Quantify / localize status codes | `--action`, `--stat_type`, `--interval` | | `hcloud CDN ShowBandwidthCalc --cli-region= --domain_name= --calc_type=bw_peak --start_time= --end_time=` | Bandwidth peak (traffic-spike correlation) | `--calc_type` | | `hcloud CDN ListDomainClientStats --cli-region= --domain_name= --stat_type=ip_num --start_time= --end_time=` | Client IP count (刷量 vs real users) | `--stat_type=ip_num` | | `hcloud CDN ListCdnDomainTopIps --cli-region= --domain_name= --stat_type=req_num --start_time= --end_time=` | Top-N drill (TopIps; same form for Path/OriginUrl/Refers/Uas; req_num only, no status) | `--stat_type=req_num` | | `hcloud CDN ShowDomainFullConfig/v2 --cli-region= --domain_name=` | Full edge config (auth/refer/ip_filter/ua/…) | — | | `hcloud CDN ShowRefer --cli-region= --domain_id=` | Referer防盗链 config | `--domain_id` | | `hcloud CDN ShowBlackWhiteList --cli-region= --domain_id=` | IP blacklist/whitelist | `--domain_id` | | `hcloud CDN ListRuleDetails --cli-region= --domain_name=` | Rule engine block rules | — | | `hcloud CDN ListBanUrl --cli-region= --start_time= --end_time= --page_number=1 --page_size=50` | Banned URLs (may need工单 whitelist) | time range | | `hcloud CDN ListAccessControlTask --cli-region= --start_time= --end_time= --limit=100` | Ban/unban tasks (may need工单 whitelist) | time range | | `hcloud CDN ShowOriginHost --cli-region= --domain_id=` | 回源HOST | `--domain_id` | | `hcloud CDN ShowResponseHeader --cli-region= --domain_id=` | Response header / error-page config | `--domain_id` | | `hcloud CDN ShowDomainDetail --cli-region= --domain_id=` | Domain detail (origin/status/CNAME) | `--domain_id` | | `hcloud CDN ShowHistoryTasks/v2 --cli-region= --file_type=file --page_number=1 --page_size=50` | Refresh/preheat history | — | | `hcloud CDN ShowCertificatesHttpsInfo/v2 --cli-region= --domain_name=` | HTTPS cert (49x/TLS) | `--domain_name` | | `hcloud CDN ShowLogs/v2 --cli-region= --domain_name= --start_time= --end_time= --page_size=100` | Log download links (single domain, ≤30 days) | `--domain_name` | | `python scripts/fetch_cdn_log.py --url [--status 403,502,503,504] [--timeout 30] [--max-lines 200]` | Fetch+decompress log, extract abnormal rows (emits JSON) | `--url`, `--status` | | `hcloud CDN ShowIpInfo/v2 --cli-region= --ips=,` | IP attribution (≤20) | `--ips` | > Top-N family `stat_type` supports only `flux`/`req_num` (no status code) — cross-reference with `ShowDomainStats`/logs. ## Parameter Confirmation | Parameter | Required | Description | Default | Example | |-----------|----------|-------------|---------|---------| | `domain_name` | Yes | CDN accelerated domain to diagnose | — | `www.example.com` | | `domain_id` | Yes (for some Show* by-id ops) | From `ListDomains/v2` | — | `d3aaa521…` | | `--cli-region` | Yes | CDN region | `cn-north-1` | `cn-north-1` | | time window | Yes | `[start,end)` ms timestamps, aligned to interval points | — | last 7 days | | `--status` (log helper) | No | Status codes to extract | `403,404,499,500,502,503,504,530` | `403,502` | **User confirmation checklist:** - [ ] Target domain provided - [ ] User understands this is read-only diagnosis - [ ] User understands log fetch has a 30s timeout ## Core Workflows ### Step 1: Discovery & Quantification — find 4xx/5xx, size, traffic correlation 📄 Detailed steps → [references/task-discovery.md](references/task-discovery.md) ### Step 2: Localize & Fork — exact code + time + edge/origin 📄 Detailed steps → [references/task-localize.md](references/task-localize.md) ### Step 3: Distribution — top-N + client-IP count 📄 Detailed steps → [references/task-distribution.md](references/task-distribution.md) ### Step 4: Root Cause — origin side (4A) / edge side (4B) per Step 2 fork 📄 Detailed steps → [references/task-rootcause.md](references/task-rootcause.md) ### Step 5: Per-request Forensics — log fetch + IP attribution 📄 Detailed steps → [references/task-forensics.md](references/task-forensics.md) ### Step 6: Report — decision tree + remediation boundary 📄 Detailed steps → [references/task-report.md](references/task-report.md) ## References | Document | Description | |----------|-------------| | [task-discovery.md](references/task-discovery.md) | Step 1: discovery & quantification | | [task-localize.md](references/task-localize.md) | Step 2: localize exact code + edge/origin fork | | [task-distribution.md](references/task-distribution.md) | Step 3: top-N/client distribution | | [task-rootcause.md](references/task-rootcause.md) | Step 4: origin-side (4A) / edge-side (4B) root cause | | [task-forensics.md](references/task-forensics.md) | Step 5: per-request log forensics | | [task-report.md](references/task-report.md) | Step 6: diagnosis report + decision tree | | [prohibited-operations.md](references/prohibited-operations.md) | All 55 prohibited non-GET operations (POST/PUT/DELETE) | | [dataflow-diagram.md](references/dataflow-diagram.md) | Mermaid data flow diagram | | [related-apis.md](references/related-apis.md) | API/CLI reference + stat_type + status-code map | | [iam-policies.md](references/iam-policies.md) | IAM least-privilege policies | | [verification-method.md](references/verification-method.md) | Verification method | | [acceptance-criteria.md](references/acceptance-criteria.md) | Acceptance criteria checklist | | [troubleshooting.md](references/troubleshooting.md) | Troubleshooting | | [cli-installation-guide.md](references/cli-installation-guide.md) | CLI installation guide |