This topic answers common questions about CDN for ApsaraVideo VOD.
Question categories
Purchase and billing
How do I view my purchased ApsaraVideo VOD data transfer plan?
Why is there a discrepancy between traffic data from monitoring, usage queries, and logs?
Why am I still charged for traffic after I purchase a data transfer plan?
Am I charged for data transfer and requests that result from attacks or other malicious activities?
Am I charged if an Alibaba Cloud CDN POP returns a 4xx status code for a request?
Access issues and exceptions
A 404 error is returned when you use a configured domain name to access ApsaraVideo VOD resources
How do I determine whether an error originates from an Alibaba Cloud CDN POP or the origin server?
Global Accelerator does not improve access speed for users outside China
Adding domain names and DNS resolution
Does ApsaraVideo VOD support wildcard domain names for acceleration?
Error when adding a domain name: The root domain is already associated with another account
"This domain name already exists" error when adding a domain name
Cache-related
Origin fetch and origin server
HTTPS-related
Refresh and prefetch
How do I update files with the same name after I configure an accelerated domain name?
Accessed resources are not updated by the refresh and prefetch feature
Security-related
How do I view my newly purchased acceleration resource plan (ApsaraVideo VOD data transfer plan)?
You can query the usage details of only resource plans that are currently active or have expired within the last year.
Log on to Expenses and Costs.
In the navigation pane on the left, select Resource Instance Management.
On the Resource Instance Management page, set Resource Dimension to Resource Plan to view its usage details.
To query for resource plans, you can set Product Name to ApsaraVideo VOD or specify other filter conditions such as effective time and status.
Why is the traffic data from monitoring and usage queries different from the traffic data in logs?
Problem description
Why is the traffic volume obtained from the data monitoring feature or the resource usage (actual billable traffic) feature in the ApsaraVideo VOD console or by calling the ApsaraVideo VOD API different from the traffic volume recorded in logs? In most cases, the traffic volume recorded in logs is less than the volume obtained from the data monitoring feature or the resource usage feature.
Possible causes
The traffic recorded in logs is based on the response size field and counts traffic only at the application layer. The actual network traffic at the network layer is typically 7% to 15% higher than the application-layer traffic. This difference is mainly caused by two types of overhead:
TCP/IP packet headers: During network transmission, application-layer data is encapsulated into TCP packets and then into IP packets. An IP packet has a maximum size of 1,500 bytes, which includes a 20-byte TCP header and a 20-byte IP header. This 40-byte header is not recorded in application-layer logs. This header overhead accounts for at least 2.74% of the traffic recorded in logs (40 bytes / 1,460 bytes). The smaller the application data payload, the larger the percentage of header overhead, which is typically around 3%.
TCP retransmission: Packet loss can occur due to network congestion or device failures. Typically, 3% to 10% of data packets are lost and must be retransmitted. The operating system kernel handles these retransmissions at the protocol stack layer, and they are not recorded in application-layer logs. This process consumes additional network traffic.
Because of this overhead, the industry standard is to add 7% to 15% to the application-layer traffic calculated from the response size in logs to determine the actual billable traffic. ApsaraVideo VOD applies an average overhead of 10%. Therefore, the actual billable traffic and the traffic shown in monitoring queries are 1.1 times the traffic recorded in logs. This is known as the TCP coefficient of 1.1.
How am I charged for using CDN points of presence in the Chinese mainland if my origin server is outside the Chinese mainland?
If your origin server is located outside the Chinese mainland, including in Hong Kong (China), Macao (China), or Taiwan (China), and you use CDN points of presence (POPs) in the Chinese mainland for acceleration, you are charged based on the standard rates for CDN acceleration in the Chinese mainland.
CDN billing is based only on the outbound traffic from CDN POPs. If you use CDN acceleration services in the Chinese mainland with an origin server located outside the Chinese mainland, you are still charged based on the standard rates for CDN services in the Chinese mainland. However, this setup can affect acceleration performance because latency may occur when CDN POPs in the Chinese mainland fetch content from an origin server outside the Chinese mainland. If your origin server and users are both outside the Chinese mainland, enable Global Accelerator.
Can I use ApsaraVideo VOD resource plans in CDN or OSS after purchase?
No. ApsaraVideo VOD is separately billed. When you use ApsaraVideo VOD, you are charged for storage, transcoding, traffic, or bandwidth. An ApsaraVideo VOD package contains resource plans such as data transfer plans, storage plans, and transcoding plans. You can use the resource plans to offset fees only for the resources that are consumed in ApsaraVideo VOD.
Why am I still charged for traffic after purchasing an ApsaraVideo VOD data transfer plan?
A purchased data transfer plan takes effect only after you configure an accelerated domain name and select the pay-by-data-transfer metering method for the domain name. After the data transfer plan takes effect, you can use the plan to offset only acceleration traffic fees. Data transfer plans cannot be used to offset OSS outbound traffic fees. If your usage exceeds the capacity of the data transfer plan, the overages are billed based on the pay-as-you-go billing method. When traffic fees are incurred, check the following items to identify the reason:
An accelerated domain name configured
Check whether the accelerated domain name is configured properly. If the accelerated domain name is not configured properly, you cannot use data transfer plans to offset acceleration traffic fees. For example, if you do not configure a CNAME record for the domain name that you added to ApsaraVideo VOD, the domain name is not accelerated. Make sure that the accelerated domain name is in the Activated state. For more information about how to configure a domain name, see What is ApsaraVideo VOD?
Check whether the pay-by-peak-bandwidth or pay-by-95th-percentile-bandwidth metering method is used for the acceleration service. You can change the current metering method to pay-by-data-transfer. For more information, see Switch between metering methods.
Check whether the accelerated domain name is used to access media assets in ApsaraVideo VOD. If you do not use the accelerated domain name to access media assets, OSS outbound traffic fees are incurred. For more information, see Billing of basic services.
Check whether your usage exceeds the capacity of the data transfer plan that you purchased. You can renew your resource plan. For more information, see Renewal.
No accelerated domain name configured
If you do not add a domain name to accelerate in ApsaraVideo VOD, OSS URLs are used to play or download media assets from ApsaraVideo VOD. In this case, OSS outbound traffic fees are incurred.
Am I charged for traffic and requests from attacks or malicious activities?
You are charged for traffic and bandwidth that are consumed by attacks. These charges apply because bandwidth resources are consumed when your traffic is maliciously inflated or attacked.
To handle maliciously inflated traffic or attacks, you can improve video security or set up peak bandwidth alerts.
Enable video security features.
If your business is at risk of attacks, we recommend that you enable video security features. ApsaraVideo VOD provides a comprehensive content security mechanism to protect video content from hotlinking and illegal downloads or distribution. This helps you meet content security requirements in different business scenarios. For more information, see Media security.
Enable peak bandwidth monitoring.
You can set an upper bandwidth limit for the domain name. When the limit is reached, ApsaraVideo VOD sends you a notification by text message. For more information, see Peak bandwidth monitoring.
Am I charged when a CDN point of presence returns a 4xx status code?
Yes. To protect your accelerated domain names against threats such as malicious attacks and fraudulent traffic, you can enable features such as Referer-based hotlink protection, URL signing, remote authentication, IP address blacklists and whitelists, and User-Agent blacklists and whitelists. These features allow you to create and use rules to manage access to your CDN points of presence (POPs). If an unauthorized request matches the rules, the CDN POP rejects the request and returns a 4xx status code. Handling the request consumes CPU resources, and returning the 4xx status code consumes traffic and bandwidth resources. Therefore, you are charged for the traffic and bandwidth that are consumed. For more information about the billing of traffic consumed in ApsaraVideo VOD, see Billing of basic services.
Why do I get a 404 error when accessing ApsaraVideo VOD resources with a configured domain name?
When a web server returns an HTTP 404 status code, it automatically redirects to a 404 page. The original URL may be inaccessible because the URL generation rules have changed, the web file was renamed or moved, or there is a spelling error in an imported link. When the web server receives such a request, it returns a 404 status code to inform the browser that the requested resource does not exist.
Make sure that the storage where the resource is located matches the domain name. If multiple storage resources exist in the same region but only one domain name is configured, the ApsaraVideo VOD console returns the CDN URL for that region by default when you access resources in other storage resources that are not bound to the domain name. This results in a 404 error.
How to determine if a CDN access exception is caused by a CDN point of presence or the origin server
Visit the Alikunlun User Diagnostic Tool and confirm that your local network is normal.
Add a resolution entry for the origin server to your local hosts file to bypass CDN and test access to the origin server directly. If an error occurs when you access the origin server, the issue is with your origin server. Contact the site administrator to fix it.
Comment out the hosts entry you added in the previous step. Ping the accelerated domain name. If the ping is successful, the CDN POP is functioning correctly.
Why does enabling Global Accelerator not improve access speed for users outside China?
Check the following items to troubleshoot the issue:
When a user outside China accesses the domain name, check the IP address that the domain name resolves to to determine if the configurations for the overseas nodes have taken effect.
The effectiveness of the overseas node configuration also depends on the request volume. Access speed improves only when the request volume at the overseas nodes is high. If the number of requests is low, fewer requests will hit the cache. In this case, adding overseas nodes will not significantly improve the access speed for users outside China.
Why does the preview feature for MP4 videos not work for an accelerated domain name in ApsaraVideo VOD?
ApsaraVideo VOD lets you preview video files in the MP4 and HLS formats. The metadata of MP4 files must be in the file header. MP4 files whose metadata is at the end of the file cannot be previewed. When ApsaraVideo VOD transcodes a video and converts its container format to MP4, the system places the metadata in the file header. If an MP4 video cannot be previewed, you must transcode the MP4 file. For more information about transcoding, see Audio and video transcoding.
Does ApsaraVideo VOD support wildcard domain names for acceleration?
No. Adding wildcard domain names, such as *.aliyundoc.com, is not supported.
What to do if I get the error "The root name of your domain is reserved by other account" when adding a domain name?
If you fail to add a domain name in the ApsaraVideo VOD console and receive the error The root name of your domain is reserved by other account, please contact our Business Advisors, this error means that the root domain of that domain name has already been added to CDN, Global Accelerator, or ApsaraVideo VOD under another Alibaba Cloud account.
If you cannot resolve the issue on your own, submit a ticket. For more information about how to submit a ticket, see Contact us.
What to do if I get the error "This domain name is exist already" when adding a domain name?
If you fail to add a domain name in the ApsaraVideo VOD console and receive the error This domain name is exist already, this error means that the domain name has already been added to another Alibaba Cloud product.
Accelerated domain names cannot be added more than once. If you receive this error, check if your domain name has been added to other cloud products, such as ApsaraVideo Live, Global Accelerator, SCDN, or Video Surveillance System.
To request technical support from Alibaba Cloud, submit a ticket. For more information about how to submit a ticket, see Contact us.
How do I test if a CNAME record is resolved correctly?
We do not recommend using the ping command for verification because the parsing information returned by the ping command may be inaccurate. You should use query tools such as nslookup or dig for verification.
Windows
On a Windows operating system, run the following command in the Command Prompt (CMD) or PowerShell to query the CNAME record:
nslookup -type=CNAME <accelerated domain name>If the returned result matches the CNAME value provided by CDN, the CNAME record has taken effect.
Linux/Mac OS
In the Terminal on a Linux or macOS system, use the
digcommand to verify:Query only the CNAME target address (recommended)
dig +short <accelerated_domain_name> CNAMEIf the returned result matches the CNAME value provided by CDN, the CNAME record has taken effect. The following is a sample result:
dig +short cdn.example.com CNAME cdn.example.com.w.alikunlun.com.Query detailed domain name information
dig <accelerated domain name> CNAMEIf the CNAME value in the
ANSWER SECTIONon the screen matches the CNAME value provided by CDN, the CNAME record has taken effect.
New accelerated domain name review failed
All domain names added to ApsaraVideo VOD must undergo content moderation. If your domain name fails the review, this may be because your domain name does not meet the compliance requirements. For more information about the standards and limits for adding domain names, see Domain Name Requirements.
If your domain name fails the review, go to the ApsaraVideo VOD console and choose Configuration Management > CDN Configuration > Domain Names. On the page that appears, view the reason for the failure. Then, delete the domain that failed the review, adjust your website content accordingly, and re-add the domain name for another review.
How to troubleshoot a low CDN cache hit ratio
A low hit rate means that many user requests are routed back to the origin through CDN. The instability of the Internet link may degrade acceleration performance. You can improve the cache hit ratio of ApsaraVideo VOD by prefetching URLs, configuring resource cache rules, and filtering variable parameters in URLs.
The following solutions can help:
Policy | Factors and scenarios | Configuration Method |
Prefetch popular resources before peak hours | Cause: If resources are not prefetched to CDN points of presence (POPs) before a major operational activity or a new package release, many resources must be retrieved from the origin server. This reduces the cache hit ratio. Scenarios:
| |
Configure a proper time-to-live (TTL) | Causes:
Application scenario: Static resources are published on the origin server but are not cached on CDN points of presence (POPs), or the resources cached on POPs expire quickly. Configuration recommendations:
| |
Ignore the parameters after the question mark (?) in URLs | Cause: If a request URL contains a queryString or other variables, CDN treats each URL as unique, even if they access the same resource. Each unique URL triggers a back-to-origin request, which lowers the cache hit ratio. Scenario: Serve the same resource for different URLs that vary only by parameters. | |
Configure a sharding back-to-origin policy for large files | Cause: A user might stop a download midway through or watch only part of a video. In these situations, the user accesses only a part of a resource file. However, the CDN point of presence (POP) requests the entire file from the origin server. As a result, the POP downloads more data from the origin than it serves to the user. This leads to a low cache hit ratio. Common scenarios: Downloading application packages or streaming video. |
Why is resource access slow after I configure an accelerated domain name in ApsaraVideo VOD?
An accelerated domain name primarily improves website access speed by adding a new layer of cache nodes to the existing network. It publishes the origin server's resources to the network nodes closest to the users. This allows the user's client to directly access the nearest CDN node and hit the resource in the cache, reducing origin fetches. Therefore, the possible causes of slow access include the following:
Client-side local network factors, such as insufficient client downstream bandwidth or configuration errors.
A poor network connection between the client and the CDN node, resulting in high network latency.
An abnormal CDN node with a slow response speed.
A large resource that requires a long download time.
A poor network connection between the CDN node and the origin server during origin fetch.
A slow response from the origin server.
Why do I get a cross-domain error "The 'Access-Control-Allow-Origin' header has a value 'xxx' that is not equal to the supplied origin" when requesting accelerated resources?
A request for an accelerated resource fails and returns the error message The 'Access-Control-Allow-Origin' header has a value 'xxx' that is not equal to the supplied origin, as shown in the following figure.
This error indicates that the value of the Access-Control-Allow-Origin header returned by CDN is different from the Origin header in the request. As a result, the browser rejects the response. For example, if the cross-origin header of the request is "Origin:http://domain name A" and the cross-origin header returned by CDN is "Access-Control-Allow-Origin:http://domain name B", the browser rejects the response.
This issue can be caused by the following reasons:
The cross-domain header configured in CDN is inconsistent with the Origin header in the client request.
The cross-domain header from the origin server is cached by CDN.
The browser cache.
Why is an HTTPS URL not included in the transcoding callback after I bind a domain name in ApsaraVideo VOD?
ApsaraVideo VOD callbacks do not currently support HTTPS. If you have correctly configured an HTTPS certificate in ApsaraVideo VOD, you can manually replace the HTTP protocol in the resource URL with HTTPS after you receive the callback message.
Callbacks for screenshots and thumbnails carry HTTPS URLs, but callbacks for transcoding return HTTP URLs.
How do I update files that have the same name after configuring an accelerated domain name?
You can submit refresh requests from the console or using OpenAPI. For more information, see Refresh and prefetch. You can submit a maximum of 2,000 refresh requests per day. Each request can contain a maximum of 1,000 URLs. Directory refresh is supported. You can submit a maximum of 100 directory refresh requests per day. For information about the related API operations, see Refresh and Prefetch API.
Why are resources not updated after I use the refresh and prefetch feature?
You can perform the following actions to troubleshoot and resolve the issue:
Try clearing your browser cache, then refresh the page to see if the resource has been updated.
Bind the site domain name directly to the origin server by modifying the local hosts file. Access the origin server directly to check if its resources are updated. If the resources are not updated, update the resources on the origin server, and then try the refresh or prefetch task again.
Log on to the ApsaraVideo VOD console and check if the refresh and prefetch task has been completed. If it has not been completed, wait for it to complete or run it again.
How do I block access from malicious IP addresses?
You can configure an IP address blacklist. The IP addresses in the IP address blacklist are blocked and cannot access resources in ApsaraVideo VOD. For more information, see Configure an IP address blacklist or whitelist.
Why can an IP address on the blacklist still access resources?
Check whether the IP address that you specified in the IP address blacklist is correct. If you want to control access from specific client IP addresses, you must configure rules based on the X-Forwarded-For (XFF) header. For more information about how to obtain the XFF header, see Retrieve the originating IP addresses of clients.
Alibaba Cloud CDN cannot prevent clients from sending requests. After you add an IP address to the IP blacklist, requests sent from this IP address receive the HTTP 403 status code. You can check the log entries generated by the requests. For more information about how to view logs, see Download logs.
If the HTTP 403 status code is returned to a client request, you are charged for the network traffic generated by returning the response header. Therefore, you are charged for only a small amount of network traffic. For more information, see Am I charged if the requested Alibaba Cloud CDN POP returns a 4xx status code?.
Why do I get a 403 error when accessing ApsaraVideo VOD accelerated resources due to a hotlink protection issue?
Problem description
After configuring hotlink protection, you receive a 403 error when accessing accelerated resources in ApsaraVideo VOD.
Possible causes
The hotlink protection settings are incorrect, or the Referer header is empty.
Solution
Identify the cause of the issue.
Use the curl command to test access to the accelerated domain name.
curl -voa -e "http://demo.aliyundoc.com" http://example.aliyundoc.comThe system displays a result similar to the following. The HTTP request header contains a Referer for the domain name demo.aliyundoc.com, a 403 error occurs, and the specific error message is "denied by Referer ACL". This indicates that the hotlink protection settings are incorrect.
Use the curl command to test access to the CDN accelerated domain name.
curl -voa http://example.aliyundoc.comThe system displays a result similar to the following. The HTTP request header does not contain Referer information, a 403 error occurs, and the specific error message is "denied by Referer ACL". This indicates that the Referer header is empty.
Open a URL accelerated by the domain name in a Chrome browser and open the developer tools. A result similar to the following is displayed. The HTTP request header does not contain Referer information. This indicates that the Referer header is empty.
Resolve the issue based on the cause.
Solution for incorrect hotlink protection settings
Check if the Referer domain name demo.aliyundoc.com matches the hotlink protection settings of the accelerated domain name example.aliyundoc.com.
Log on to the ApsaraVideo VOD console. In the navigation pane on the left, choose Configuration Management > CDN Configuration > Domain Names. On the page that appears, find the target domain name and click Configure in the Actions column. Then, choose Access Control > Referer Hotlink Protection > Modify Configuration. In the dialog box that appears, set the Referer type to Whitelist. If the hotlink protection setting does not match the referer of the request, add demo.aliyundoc.com to the Referer whitelist.
Solution for an empty Referer header
Log on to the ApsaraVideo VOD console and choose Configuration Management > CDN Configuration > Domain Names. Click Configure for the target domain name, choose Resource Access Control > Referer Hotlink Protection > Modify, and check Allow Access To Resource URL From Browser Address Bar.
NoteAllowing access with an empty Referer header may expose your resources to hotlinking risks.