Imported from huaweicloud/huaweicloud-skills (skills/edge/cdn/huawei-cloud-cdn-abnormal-status-code-analysis/SKILL.md). Install upstream with npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-cdn-abnormal-status-code-analysis. Copyright stays with the author.

CDN Abnormal Status Code Analysis

Overview

This skill diagnoses abnormal HTTP status codes (4xx / 5xx) on a Huawei Cloud CDN accelerated domain. It is read-only end to end: every action is a query (GET statistics / GET config / GET log-download-link / read-only log fetch). It answers four questions for any 4xx/5xx anomaly:

1. Is there an anomaly, and how big? — quantify 4xx/5xx volume and ratio over a window.
2. Which exact code, when, edge or origin? — drill to the specific code + time bucket, and fork edge-generated vs origin-generated via the back-to-source (bs_*) status statistics.
3. Who / where / what path? — top IPs/paths/UA/referer, client IP count (刷量 vs real users).
4. Root cause + forensics? — narrow to edge-config rules or origin-side issues, then pin the exact requests via access logs.

Key Features:

• Edge-vs-origin fork driven by one command (bs_status_code_*): result={} ⇒ edge-generated; non-empty ⇒ origin-generated.
• Covers the full 4xx/5xx set: 400/401/403/404/405/406/408/410/412/416/429/499/495/496/500/501/502/503/504/505/530….
• Read-only log helper scripts/fetch_cdn_log.py downloads + decompresses a CDN log and extracts the abnormal-status rows as JSON.
• Structured diagnosis report with a status-code → root-cause decision tree and console/工单 remediation boundary (no CLI write ops).

Tools: hcloud CLI (KooCLI) + Python log helper (scripts/fetch_cdn_log.py). Core Principle: Read-only diagnosis; no configuration changes.

⛔ Prohibited Operations (Security Constraints)

This skill strictly prohibits all non-GET (write/modify/delete) CDN operations, even if requested by the user.

Total: 55 prohibited operations (24 POST + 25 PUT + 6 DELETE).

For the complete list of all 55 prohibited non-GET operations with risk descriptions, see references/prohibited-operations.md.

Representative prohibited operations (full list in the reference doc):

If the user requests a prohibited operation, refuse and inform: "Per security constraints, this skill performs read-only diagnosis only and does not run any write/delete operations. To change CDN configuration, use the Huawei Cloud CDN console or run the relevant hcloud command manually — this skill will not execute it. The complete list of 55 prohibited operations is documented in references/prohibited-operations.md."

Architecture

CDN Abnormal Status Code Analysis (read-only)
├── ListDomains/v2                       (target domain → domain_id)
├── ShowDomainStats/v2
│   ├── summary  http_code_2xx..5xx + req_num    → quantify 4xx/5xx volume + ratio
│   └── detail   status_code_4xx/5xx             → exact code + time array
├── ShowDomainStats/v2  bs_status_code_4xx/5xx    → ★ edge vs origin fork ★
├── ShowBandwidthCalc / ListDomainClientStats      → traffic-spike / 刷量 correlation
├── Top-N family                                    → who / where / what path
├── Root cause fork
│   ├── origin side: ShowOriginHost / ShowDomainDetail / ShowHistoryTasks / TopOriginUrl
│   └── edge side:   ShowDomainFullConfig / ShowRefer / ShowBlackWhiteList /
│                    ListRuleDetails / ListBanUrl / ListAccessControlTask /
│                    ShowResponseHeader / ShowCertificatesHttpsInfo
├── ShowLogs/v2 + python scripts/fetch_cdn_log.py  → per-request forensics (JSON)
├── ShowIpInfo/v2                                   → client/edge IP attribution
└── generate diagnosis report

API Call Budget

Total estimated time: < 45 seconds (log-heavy window may be longer).

KooCLI Command Format Standard

hcloud CDN <Operation> --cli-region=<region> [--key=value ...]

• Service name: CDN (uppercase). Operation name: PascalCase (e.g., ShowDomainStats/v2).
• Region parameter: --cli-region=<region>. CDN supports cn-north-1 (Beijing) and ap-southeast-1 (Singapore); results are region-independent. Recommended: cn-north-1 uniformly. (cn-north-4 is NOT supported by CDN.)
• Parameter format: --key=value (equals sign, no spaces). Space-separated form is unsupported.
• Output: append --cli-output=json for machine parsing.

Prerequisites

Pre-check: hcloud (KooCLI) >= 3.2.0 — hcloud version. If missing, see references/cli-installation-guide.md.

Pre-check: Python >= 3.8 — python --version. Required by scripts/fetch_cdn_log.py.

Pre-check: Python requests >= 2.25 — python -c "import requests; print('ok')". The log helper downloads via requests. Install if missing: pip install requests>=2.25

Pre-check: hcloud credentials — hcloud configure list. If invalid, stop and guide secure configuration. Never read/echo/print AK/SK; never ask the user to paste AK/SK in chat.

⚠️ hcloud parameter format: all params must use --key=value.

⚠️ CDN region: use cn-north-1 uniformly (CDN does not support cn-north-4).

⚠️ Time / interval rules: time = ms timestamp, [start,end) left-closed right-open; interval=300 (≤2d, 5-min points) / 3600 (≤7d, hour points) / 86400 (≤31d, CST 0:00 points). status_code_* (edge) and bs_status_code_* (origin) cannot be mixed in one query.

Authentication

• Prohibited: reading/echoing/printing AK/SK; asking users to input AK/SK in chat; hcloud configure set with plaintext; accepting AK/SK pasted by the user.
• Allowed: read credentials from environment variables or the active CLI profile only.
• If the user pastes AK/SK, stop, refuse, and emit the secure setup template (export HUAWEICLOUD_SDK_AK=... / HUAWEICLOUD_SDK_SK=...), then wait.
• Verify: hcloud configure list — confirm a valid profile exists; if not, stop.

IAM Permission Policies

See references/iam-policies.md. Minimum: read-only CDN query scope (cdn:domain:get + statistics/log query). The simplest grant is the system read-only policy CDN Domain Viewer ("Allow Query Domains"). No write permissions are required or included.

Core Commands

Top-N family stat_type supports only flux/req_num (no status code) — cross-reference with ShowDomainStats/logs.

Parameter Confirmation

User confirmation checklist:

• Target domain provided
• User understands this is read-only diagnosis
• User understands log fetch has a 30s timeout

Core Workflows

Step 1: Discovery & Quantification — find 4xx/5xx, size, traffic correlation

📄 Detailed steps → references/task-discovery.md

Step 2: Localize & Fork — exact code + time + edge/origin

📄 Detailed steps → references/task-localize.md

Step 3: Distribution — top-N + client-IP count

📄 Detailed steps → references/task-distribution.md

Step 4: Root Cause — origin side (4A) / edge side (4B) per Step 2 fork

📄 Detailed steps → references/task-rootcause.md

Step 5: Per-request Forensics — log fetch + IP attribution

📄 Detailed steps → references/task-forensics.md

Step 6: Report — decision tree + remediation boundary

📄 Detailed steps → references/task-report.md

References