RockCloud-基石云安全-官方博客
How to Read Traffic and Network Logs in a CDN Console: From Dashboard Anomalies to Individual Requests
The CDN console has two layers: dashboards answer 'when and how much', logs answer 'who and what'. This article provides a three-minute inspection sequence, essential log fields, and troubleshooting paths for four types of anomalies: traffic spikes, cache hit rate drops, 403 surges, and 502/504 errors.
How to Determine if It's a Slowloris CC Attack: Don't Just Check access.log
When server response slows down with connection buildup but low bandwidth and QPS, slowloris CC attacks often hide from access.log. This article provides troubleshooting steps starting from connection state, using ss commands, worker usage, and FD curves to locate connection exhaustion, along with layered mitigation strategies for origin limiting and edge buffering.
