Detecting and Resolving CCN Bandwidth Issues with CLS Log Analytics

Cloud Connect Network (CCN) provides private network interconnection across VPCs and between VPCs and on‑premises data centers in more than 20 regions. By integrating CCN with Cloud Log Service (CLS), users can quickly collect flow logs, search, visualize, and set alerts to detect and resolve network issues.

Scenario: Online Education Platform

Qin, an operations engineer for an online education product, needs to ensure low‑latency, high‑quality video and audio streams across multiple regions. During peak class periods, limited bandwidth causes occasional stutters, prompting the need for real‑time monitoring and rapid bandwidth scaling.

Setting Up Reject‑Traffic Alerts

Qin creates a CLS query that calculates the proportion of rejected traffic in the last five minutes. When the reject ratio exceeds 1 %, an alert is triggered.

log-status:OK | select round(sum(case when action = 'REJECT' then 1.00 else 0.00 end) / cast(count(*) as double) * 100, 2) as "reject_ratio(%)"

Analyzing the Root Cause

Upon receiving an alert, Qin filters the CCN flow logs for records where action = 'REJECT' and examines several dimensions:

Region Distribution : Identify which source‑destination region pairs generate most rejections.

log-status:OK | select concat(concat('srcRegion : ', srcregionid, ' , dstRegion : '), dstregionid) as region, sum(bytes) as bytes group by region order by bytes desc limit 20

The analysis shows that most rejected traffic occurs between ap‑guangzhou and ap‑shanghai.

IP Distribution : Check whether a few IPs dominate the rejected traffic.

log-status:OK | select sum(bytes) as total, concat(concat('srcIP : ', srcaddr, ' , dstIP : '), dstaddr) as region_ip group by region_ip order by total desc limit 20

The IP distribution is uniform, ruling out malicious bandwidth hogging.

Protocol & Port Distribution : Verify if a specific protocol or port is responsible.

log-status:OK | select sum(bytes) as bytes, concat(concat(cast(protocol as varchar), ' srcport:'), srcport, ' dstport:', dstport) as protocol group by protocol limit 10

No single protocol or port shows abnormal rejection rates.

Bandwidth Trend Analysis

Since the reject ratio rise appears linked to a surge of normal users, Qin examines bandwidth usage on the affected routes.

log-status:OK | select histogram(cast(__TIMESTAMP__ as timestamp), interval 1 MINUTE) as time, sum(bytes)/60.00*8 as bandwidth, concat(concat('srcRegion : ', srcregionid, ' , dstRegion : '), dstregionid) as region_ip group by time, region_ip limit 10000

The peak bandwidth for both ap‑guangzhou → ap‑shanghai and ap‑shanghai → ap‑guangzhou routes hovers around 7 Gb/s.

Remediation

Based on the findings, Qin increases the bandwidth limits for the two routes in the CCN console, instantly resolving the performance degradation and restoring a smooth learning experience for students.