6. Access Analytics: Understanding Your CDN Reports

6.1 Core Metrics Explained

Bandwidth

Definition: Amount of data transferred per unit of time
Unit: bps (bits per second), Mbps, Gbps

CDN bandwidth = Total egress traffic from all edge nodes

Note the distinction:
- Billing bandwidth: Usually billed by 95th percentile peak or daily peak
- Actual bandwidth: Real-time transfer rate

Relationship Between Bandwidth and Traffic:

1 Mbps bandwidth running continuously for 1 hour = 450 MB of traffic
(Calculation: 1,000,000 bps × 3600s ÷ 8 ÷ 1024 ÷ 1024 ≈ 429 MB)

QPS (Queries Per Second)

Definition: Number of queries/requests per second

CDN QPS = Total HTTP requests processed per second across all edge nodes

Note: High QPS doesn't mean high bandwidth
- Small file scenarios: High QPS, low bandwidth
- Large file scenarios: Low QPS, high bandwidth

Hit Ratio

Definition: Proportion of requests served from CDN edge node cache out of total requests

Formula:
Hit Ratio = (Hits / Total Requests) × 100%
or
Hit Ratio = (1 - Origin Fetch Traffic / Total Egress Traffic) × 100%

Industry standards:
- Images/videos/JS/CSS: > 95%
- HTML pages: 50-80% (depending on update frequency)
- API endpoints: Usually not cached or very low

Common Causes of Low Hit Ratio:

Cause	Symptom	Solution
Cache time too short	TTL only a few minutes	Adjust TTL by file type
Query parameter changes	URL carries random numbers	Configure to ignore specific params
Improper cache key	Things that shouldn't differ are differentiated	Optimize cache key rules
Frequent content updates	Files frequently overwritten	Use version numbers or hash filenames
Many first-time visits	New content or new nodes	Preheat in advance

6.2 Log Analysis and Troubleshooting

CDN Log Field Breakdown

A typical CDN access log contains the following fields:

Time | Client IP | Request Method | URL | HTTP Status Code | Response Size | Cache Status | Response Time | Referer | User-Agent

Example:
2024-01-15 14:32:01 | 114.114.114.114 | GET | https://cdn.example.com/images/photo.jpg | 200 | 153600 | HIT | 23 | https://example.com/ | Mozilla/5.0...

Key Field Explanations:

Field	Description	Analysis Value
cache_status	Cache status	HIT (hit), MISS (miss), EXPIRED (expired)
response_time	Response time (ms)	Determines user experience; optimize if >500ms
http_status	HTTP status code	Troubleshoot 404/500 errors
bytes_sent	Bytes sent	Bandwidth statistics

Common Troubleshooting

Issue 1: Users Report Slow Access

Troubleshooting steps:

1. Check log response_time
   - If high (>500ms): Check if cache MISS or slow origin

2. Check cache_status
   - HIT: Cache hit; slowness may be due to large file or node issue
   - MISS: Cache miss; need to optimize cache strategy or hit ratio

3. Check client IP distribution
   - Slow in certain regions: May be high node load or insufficient coverage

Issue 2: Cache Not Taking Effect, Always Fetching from Origin

Troubleshooting checklist:

□ Does the origin response header have Cache-Control: no-cache / private?
□ Does the URL carry random parameters (e.g., ?_=123456)?
□ Is the cache key configuration correct?
□ Is the TTL too short?
□ Is it hitting the browser's local cache instead of CDN?

Issue 3: Sudden Cost Spike

Investigation directions:

1. Check bill details
   - High CDN traffic cost: Check if large files are being frequently accessed or hotlinked
   - High origin fetch traffic cost: Check if hit ratio has dropped sharply
   - High request count cost: Check for CC attacks or crawlers

2. Check access logs
   - Are there many 404 requests (possibly scanning or configuration errors)?
   - Is the Referer abnormal (to determine if hotlinking)?

3. Security settings
   - Enable hotlink protection (Referer whitelist)
   - Enable IP blacklist/whitelist
   - Configure CC protection