huawei-cloud-cdn-abnormal-status-code-analysis

Diagnose CDN business abnormal HTTP status codes (4xx/5xx) using hcloud CLI. Discover and quantify 4xx/5xx volume, localize the exact status code and time window, fork edge-generated vs origin-generated via back-to-source status statistics, correlate top-N distribution, narrow root cause on CDN edge config or origin side, and取证 per-request access logs. Use this skill when the user wants to: (1) diagnose CDN abnormal 4xx/5xx status codes, (2) root-cause a 403/404/5xx spike on a CDN domain, (3) tell whether abnormal codes are generated by the CDN edge or returned by the origin, (4) troubleshoot CDN business exception status codes during daily inspection or incidents. Triggers include: 状态码异常, 业务异常码, 4xx, 5xx, 403, 404, 502, 503, 504, status code, abnormal status, CDN异常, 边缘/回源, 限流, status code analysis, edge vs origin

huaweicloud-skills-team@huaweiclouddev

Install

openclaw skills install @huaweiclouddev/huawei-cloud-cdn-abnormal-status-code-analysis

CDN Abnormal Status Code Analysis

Overview

This skill diagnoses abnormal HTTP status codes (4xx / 5xx) on a Huawei Cloud CDN accelerated domain. It is read-only end to end: every action is a query (GET statistics / GET config / GET log-download-link / read-only log fetch). It answers four questions for any 4xx/5xx anomaly:

Is there an anomaly, and how big? — quantify 4xx/5xx volume and ratio over a window.
Which exact code, when, edge or origin? — drill to the specific code + time bucket, and fork edge-generated vs origin-generated via the back-to-source (bs_*) status statistics.
Who / where / what path? — top IPs/paths/UA/referer, client IP count (刷量 vs real users).
Root cause + forensics? — narrow to edge-config rules or origin-side issues, then pin the exact requests via access logs.

Key Features:

Edge-vs-origin fork driven by one command (bs_status_code_*): result={} ⇒ edge-generated; non-empty ⇒ origin-generated.
Covers the full 4xx/5xx set: 400/401/403/404/405/406/408/410/412/416/429/499/495/496/500/501/502/503/504/505/530….
Read-only log helper scripts/fetch_cdn_log.py downloads + decompresses a CDN log and extracts the abnormal-status rows as JSON.
Structured diagnosis report with a status-code → root-cause decision tree and console/工单 remediation boundary (no CLI write ops).

Tools: hcloud CLI (KooCLI) + Python log helper (scripts/fetch_cdn_log.py). Core Principle: Read-only diagnosis; no configuration changes.

⛔ Prohibited Operations (Security Constraints)

This skill strictly prohibits all non-GET (write/modify/delete) CDN operations, even if requested by the user.

Total: 55 prohibited operations (24 POST + 25 PUT + 6 DELETE).

For the complete list of all 55 prohibited non-GET operations with risk descriptions, see references/prohibited-operations.md.

Representative prohibited operations (full list in the reference doc):

Prohibited Operation	Example CLI	Reason
❌ Create domain	`CreateDomain` (v1/v2), `CreateDomainByDuplicate`	Write op, creates production resource
❌ Delete domain	`DeleteDomain` (v1/v2)	Irreversible
❌ Modify domain config	`hcloud CDN UpdateDomainFullConfig` / `UpdateBlackWhiteList` / `UpdateRefer` / `UpdateResponseHeader` / `UpdateOriginHost` / `UpdateCacheRules` / `UpdateHttpsInfo`	Write op, affects production traffic
❌ Enable / disable domain	`EnableDomain` (v1/v2), `DisableDomain` (v1/v2)	Write op, affects production traffic
❌ Refresh / preheat	`hcloud CDN CreateRefreshTasks` / `CreatePreheatingTasks`	Write op, changes cache
❌ Modify billing mode	`SetChargeModes`	Financial impact
❌ Verify domain owner	`hcloud CDN VerifyDomainOwner`	Write op
❌ Set stats config / export open	`SetStatsConfig` / `ExportStatsOpen`	Write op

If the user requests a prohibited operation, refuse and inform: "Per security constraints, this skill performs read-only diagnosis only and does not run any write/delete operations. To change CDN configuration, use the Huawei Cloud CDN console or run the relevant hcloud command manually — this skill will not execute it. The complete list of 55 prohibited operations is documented in references/prohibited-operations.md."

Architecture

text

CDN Abnormal Status Code Analysis (read-only)
├── ListDomains/v2                       (target domain → domain_id)
├── ShowDomainStats/v2
│   ├── summary  http_code_2xx..5xx + req_num    → quantify 4xx/5xx volume + ratio
│   └── detail   status_code_4xx/5xx             → exact code + time array
├── ShowDomainStats/v2  bs_status_code_4xx/5xx    → ★ edge vs origin fork ★
├── ShowBandwidthCalc / ListDomainClientStats      → traffic-spike / 刷量 correlation
├── Top-N family                                    → who / where / what path
├── Root cause fork
│   ├── origin side: ShowOriginHost / ShowDomainDetail / ShowHistoryTasks / TopOriginUrl
│   └── edge side:   ShowDomainFullConfig / ShowRefer / ShowBlackWhiteList /
│                    ListRuleDetails / ListBanUrl / ListAccessControlTask /
│                    ShowResponseHeader / ShowCertificatesHttpsInfo
├── ShowLogs/v2 + python scripts/fetch_cdn_log.py  → per-request forensics (JSON)
├── ShowIpInfo/v2                                   → client/edge IP attribution
└── generate diagnosis report

API Call Budget

Step	API / Script	Rate Limit	Est. Time
1	`hcloud CDN ListDomains/v2 --cli-region={region}`	—	<2s
2	`hcloud CDN ShowDomainStats/v2 --cli-region={region}` (summary + detail + bs)	5/s	<3s
3	Top-N family + `ListDomainClientStats`	2-5/s	<5s
4	`hcloud CDN ShowDomainFullConfig/v2 --cli-region={region}` + Show* config	—	<5s
5	`hcloud CDN ShowLogs/v2 --cli-region={region}` + `python scripts/fetch_cdn_log.py`	—	≤ 30s

Total estimated time: < 45 seconds (log-heavy window may be longer).

KooCLI Command Format Standard

bash

hcloud CDN <Operation> --cli-region=<region> [--key=value ...]

Service name: CDN (uppercase). Operation name: PascalCase (e.g., ShowDomainStats/v2).
Region parameter: --cli-region=<region>. CDN supports cn-north-1 (Beijing) and ap-southeast-1 (Singapore); results are region-independent. Recommended: cn-north-1 uniformly. (cn-north-4 is NOT supported by CDN.)
Parameter format: --key=value (equals sign, no spaces). Space-separated form is unsupported.
Output: append --cli-output=json for machine parsing.

Prerequisites

Pre-check: hcloud (KooCLI) >= 3.2.0 — hcloud version. If missing, see references/cli-installation-guide.md.

Pre-check: Python >= 3.8 — python --version. Required by scripts/fetch_cdn_log.py.

Pre-check: Python requests >= 2.25 — python -c "import requests; print('ok')". The log helper downloads via requests. Install if missing: pip install requests>=2.25

Pre-check: hcloud credentials — hcloud configure list. If invalid, stop and guide secure configuration. Never read/echo/print AK/SK; never ask the user to paste AK/SK in chat.

⚠️ hcloud parameter format: all params must use --key=value.

⚠️ CDN region: use cn-north-1 uniformly (CDN does not support cn-north-4).

⚠️ Time / interval rules: time = ms timestamp, [start,end) left-closed right-open; interval=300 (≤2d, 5-min points) / 3600 (≤7d, hour points) / 86400 (≤31d, CST 0:00 points). status_code_* (edge) and bs_status_code_* (origin) cannot be mixed in one query.

Authentication

Prohibited: reading/echoing/printing AK/SK; asking users to input AK/SK in chat; hcloud configure set with plaintext; accepting AK/SK pasted by the user.
Allowed: read credentials from environment variables or the active CLI profile only.
If the user pastes AK/SK, stop, refuse, and emit the secure setup template (export HUAWEICLOUD_SDK_AK=... / HUAWEICLOUD_SDK_SK=...), then wait.
Verify: hcloud configure list — confirm a valid profile exists; if not, stop.

IAM Permission Policies

See references/iam-policies.md. Minimum: read-only CDN query scope (cdn:domain:get + statistics/log query). The simplest grant is the system read-only policy CDN Domain Viewer ("Allow Query Domains"). No write permissions are required or included.

Core Commands

Command	Purpose	Key Parameters
`hcloud configure list`	Check credentials	none
`hcloud CDN ListDomains/v2 --cli-region=<region>`	List domains → domain_id	—
`hcloud CDN ShowDomainStats/v2 --cli-region=<region> --action=summary\|detail --domain_name=<d> --stat_type=<t> --start_time=<ms> --end_time=<ms> --interval=<s>`	Quantify / localize status codes	`--action`, `--stat_type`, `--interval`
`hcloud CDN ShowBandwidthCalc --cli-region=<region> --domain_name=<d> --calc_type=bw_peak --start_time=<ms> --end_time=<ms>`	Bandwidth peak (traffic-spike correlation)	`--calc_type`
`hcloud CDN ListDomainClientStats --cli-region=<region> --domain_name=<d> --stat_type=ip_num --start_time=<ms> --end_time=<ms>`	Client IP count (刷量 vs real users)	`--stat_type=ip_num`
`hcloud CDN ListCdnDomainTopIps --cli-region=<region> --domain_name=<d> --stat_type=req_num --start_time=<ms> --end_time=<ms>`	Top-N drill (TopIps; same form for Path/OriginUrl/Refers/Uas; req_num only, no status)	`--stat_type=req_num`
`hcloud CDN ShowDomainFullConfig/v2 --cli-region=<region> --domain_name=<d>`	Full edge config (auth/refer/ip_filter/ua/…)	—
`hcloud CDN ShowRefer --cli-region=<region> --domain_id=<id>`	Referer防盗链 config	`--domain_id`
`hcloud CDN ShowBlackWhiteList --cli-region=<region> --domain_id=<id>`	IP blacklist/whitelist	`--domain_id`
`hcloud CDN ListRuleDetails --cli-region=<region> --domain_name=<d>`	Rule engine block rules	—
`hcloud CDN ListBanUrl --cli-region=<region> --start_time=<ms> --end_time=<ms> --page_number=1 --page_size=50`	Banned URLs (may need工单 whitelist)	time range
`hcloud CDN ListAccessControlTask --cli-region=<region> --start_time=<ms> --end_time=<ms> --limit=100`	Ban/unban tasks (may need工单 whitelist)	time range
`hcloud CDN ShowOriginHost --cli-region=<region> --domain_id=<id>`	回源HOST	`--domain_id`
`hcloud CDN ShowResponseHeader --cli-region=<region> --domain_id=<id>`	Response header / error-page config	`--domain_id`
`hcloud CDN ShowDomainDetail --cli-region=<region> --domain_id=<id>`	Domain detail (origin/status/CNAME)	`--domain_id`
`hcloud CDN ShowHistoryTasks/v2 --cli-region=<region> --file_type=file --page_number=1 --page_size=50`	Refresh/preheat history	—
`hcloud CDN ShowCertificatesHttpsInfo/v2 --cli-region=<region> --domain_name=<d>`	HTTPS cert (49x/TLS)	`--domain_name`
`hcloud CDN ShowLogs/v2 --cli-region=<region> --domain_name=<d> --start_time=<ms> --end_time=<ms> --page_size=100`	Log download links (single domain, ≤30 days)	`--domain_name`
`python scripts/fetch_cdn_log.py --url <link> [--status 403,502,503,504] [--timeout 30] [--max-lines 200]`	Fetch+decompress log, extract abnormal rows (emits JSON)	`--url`, `--status`
`hcloud CDN ShowIpInfo/v2 --cli-region=<region> --ips=<ip1>,<ip2>`	IP attribution (≤20)	`--ips`

Top-N family stat_type supports only flux/req_num (no status code) — cross-reference with ShowDomainStats/logs.

Parameter Confirmation

Parameter	Required	Description	Default	Example
`domain_name`	Yes	CDN accelerated domain to diagnose	—	`www.example.com`
`domain_id`	Yes (for some Show* by-id ops)	From `ListDomains/v2`	—	`d3aaa521…`
`--cli-region`	Yes	CDN region	`cn-north-1`	`cn-north-1`
time window	Yes	`[start,end)` ms timestamps, aligned to interval points	—	last 7 days
`--status` (log helper)	No	Status codes to extract	`403,404,499,500,502,503,504,530`	`403,502`

User confirmation checklist:

Target domain provided
User understands this is read-only diagnosis
User understands log fetch has a 30s timeout

Core Workflows

References

Document	Description
task-discovery.md	Step 1: discovery & quantification
task-localize.md	Step 2: localize exact code + edge/origin fork
task-distribution.md	Step 3: top-N/client distribution
task-rootcause.md	Step 4: origin-side (4A) / edge-side (4B) root cause
task-forensics.md	Step 5: per-request log forensics
task-report.md	Step 6: diagnosis report + decision tree
prohibited-operations.md	All 55 prohibited non-GET operations (POST/PUT/DELETE)
dataflow-diagram.md	Mermaid data flow diagram
related-apis.md	API/CLI reference + stat_type + status-code map
iam-policies.md	IAM least-privilege policies
verification-method.md	Verification method
acceptance-criteria.md	Acceptance criteria checklist
troubleshooting.md	Troubleshooting
cli-installation-guide.md	CLI installation guide