CDN Abnormal Status Code Analysis

Overview

This skill diagnoses abnormal HTTP status codes (4xx / 5xx) on a Huawei Cloud CDN accelerated domain. It is read-only end to end: every action is a query (GET statistics / GET config / GET log-download-link / read-only log fetch). It answers four questions for any 4xx/5xx anomaly:

1. Is there an anomaly, and how big? — quantify 4xx/5xx volume and ratio over a window.
2. Which exact code, when, edge or origin? — drill to the specific code + time bucket, and fork edge-generated vs origin-generated via the back-to-source (bs_*) status statistics.
3. Who / where / what path? — top IPs/paths/UA/referer, client IP count (刷量 vs real users).
4. Root cause + forensics? — narrow to edge-config rules or origin-side issues, then pin the exact requests via access logs.

Key Features:

• Edge-vs-origin fork driven by one command (bs_status_code_*): result={} ⇒ edge-generated; non-empty ⇒ origin-generated.
• Covers the full 4xx/5xx set: 400/401/403/404/405/406/408/410/412/416/429/499/495/496/500/501/502/503/504/505/530….
• Read-only log helper scripts/fetch_cdn_log.py downloads + decompresses a CDN log and extracts the abnormal-status rows as JSON.
• Structured diagnosis report with a status-code → root-cause decision tree and console/工单 remediation boundary (no CLI write ops).