This topic describes some commonly asked questions about CDN in ApsaraVideo VOD.
Categories
Purchase and billing
How do I view the ApsaraVideo VOD data transfer plan that I purchased?
Why am I still charged traffic fees after I purchase a data transfer plan?
Am I charged if the requested Alibaba Cloud CDN POP returns a 4xx status code?
Service unavailability and exceptions
Domain names
Does ApsaraVideo VOD support the acceleration of wildcard domain names?
What do I do if the domain name I add to accelerate fails the review?
Cache
What do I do if access speed is low after I configure an accelerated domain name in ApsaraVideo VOD?
Origin fetch and origin server
HTTPS
Refresh and prefetch
How do I refresh files with the same name after I configure an accelerated domain name?
What do I do if the resources are not updated after I use the refresh or prefetch feature?
Security
How do I view the ApsaraVideo VOD data transfer plan that I purchased?
Log on to the ApsaraVideo VOD console.
In the top navigation bar, choose Expenses > User Center. On the page that appears, click Manage Reserved Instances to view information about resource plans.
Why is the traffic volume that is found when using the data monitoring feature or the resource usage feature different from the traffic volume that is logged?
Problem description
Why is the traffic volume that is found when using the data monitoring feature or the resource usage feature in the ApsaraVideo VOD console or by calling the ApsaraVideo VOD API different from the traffic volume that is logged? In most cases, the traffic volume that is logged is less than the volume that is found by using the data monitoring feature or the resource usage feature.
Cause
The logged traffic volume that is recorded by the response size field in logs includes only the volume of traffic that is collected at the application layer. The actual volume of network traffic at the network layer is 7% to 15% higher than the volume that is collected at the application layer. The difference between the traffic at the network layer and that at the application layer includes the following items:
Insertion of TCP and IP packets: Before data transmission, traffic at the application layer needs to be encapsulated into TCP packets by using the TCP protocol at the transport layer and then encapsulated into IP packets by using the IP protocol at the network layer. The maximum size of an IP packet is 1,500 bytes, in which the TCP protocol header and the IP protocol header occupy 40 bytes in total and each occupies 20 bytes. The traffic consumed by the headers is not collected at the application layer. Therefore, the 40 bytes are not logged. The traffic consumed by the headers accounts for at least 2.74% (40/(1,500-40)) of the logged traffic. The smaller the application layer data, the larger the proportion. In most cases, the proportion is approximately 3%.
Retransmission of TCP packets: Due to the complex network conditions on the Internet, 3% to 10% of packets are lost due to network congestion and device failures. The retransmission of lost packets is processed by the protocol stack of the OS kernel and cannot be logged at the application layer. The retransmission of TCP packets also consumes traffic.
Due to the preceding additional traffic-consuming items, the actual traffic amount is conventionally the sum of the traffic amount that is recorded by the response size field in logs and 7% to 15% of the additional traffic. Bills are generated based on the actual traffic amount. Alibaba Cloud CDN includes only 10% of the additional traffic to the actual traffic amount. Therefore, you are charged for the actual traffic amount that is 1.1 times of the traffic amount recorded by the response size field in logs.
If my origin server is located outside the Chinese mainland, how am I charged for using Alibaba Cloud CDN POPs in the Chinese mainland?
If your origin server is located outside the Chinese mainland such as China (Hong Kong), China (Macao), or China (Taiwan) and you use Alibaba Cloud CDN points of presence (POPs) in the Chinese mainland to accelerate content delivery, you are charged based on the billing standards for the Chinese mainland.
This is because only outbound traffic of POPs is billed. However, in this case, the optimizations offered by Alibaba Cloud CDN are compromised as the latency may occur for back-to-origin requests. If your origin server and end users are both located in regions outside the Chinese mainland, we recommend that you enable global acceleration.
Can I use the resource plans in the ApsaraVideo VOD package that I purchased to offset bills for Alibaba Cloud CDN and OSS?
No. ApsaraVideo VOD is an independent service. When you use ApsaraVideo VOD, you are charged for storage, transcoding, traffic, or bandwidth resources consumed. An ApsaraVideo VOD package contains resource plans such as data transfer plans, storage plans, and transcoding plans. You can use the resource plans to pay only for the resources that are consumed in ApsaraVideo VOD.
Why are traffic fees not covered by the data transfer plan that I purchased?
A purchased ApsaraVideo VOD data transfer plan takes effect only after you configure an accelerated domain name and use the pay-by-data-transfer metering method. After the data transfer plan takes effect, it can be used to offset only acceleration traffic fees. Data transfer plans cannot be used to offset OSS outbound traffic fees. If your usage exceeds the capacity of the data transfer plan, the overages are billed based on the pay-as-you-go billing method. When traffic fees are incurred, check the following items to identify the reason:
- An accelerated domain name configured
- Check whether the accelerated domain name is configured properly. If the accelerated domain name is not configured properly, you cannot use data transfer plans to offset acceleration traffic fees. For example, if you do not configure a CNAME record for the domain name that you added to ApsaraVideo VOD, the domain name is not accelerated. Make sure that the accelerated domain name is in the Activated state. For more information about how to configure domain names, see Configure an accelerated domain name.
- Check whether the pay-by-peak-bandwidth or pay-by-95th-percentile-bandwidth metering method is used for the acceleration service. You can change the current metering method to pay-by-data-transfer. For more information, see Switch between metering methods.
- Check whether the accelerated domain name is used to access media assets in ApsaraVideo VOD. If you do not use the accelerated domain name to access media assets, OSS outbound traffic fees are incurred.
- Check whether your usage exceeds the capacity of the data transfer plan that you purchased. You can renew your resource plan. For more information, see Renew a resource plan.
- No accelerated domain name configured
If you do not add a domain name to accelerate in ApsaraVideo VOD, OSS URLs are used to play or download media assets from ApsaraVideo VOD. In this case, OSS outbound traffic fees are incurred.
Am I charged for data transfer and requests that are generated by attacks or other malicious behaviors such as click farming?
You are charged for bandwidth resources and data transfer regardless of whether the traffic is legitimate. Attacks or malicious behaviors that cause traffic spikes and increase bandwidth usage will generate costs.
To prevent this issue, improve video security or configure peak bandwidth monitoring.
Enable security-related features
If your business is at risk of attacks, we recommend that you improve video security to prevent attacks. ApsaraVideo VOD provides a comprehensive content security mechanism to protect video content from hotlinking and illegal downloads or distribution. This allows you to meet content security requirements in different business scenarios. For more information, see Overview.
Enable peak bandwidth monitoring
Set an upper bandwidth limit for the domain name. This way, ApsaraVideo VOD sends you notifications by text messages when the upper bandwidth limit is reached. For more information, see Peak bandwidth monitoring.
Am I charged if the requested Alibaba Cloud CDN POP returns a 4xx status code?
Yes. To protect your accelerated domain names against threats such as malicious attacks and fraudulent traffic, you can enable the following features: Referer-based hotlink protection, URL signing, remote authentication, IP blacklist and whitelist, and User-Agent blacklist and whitelist. These features allow you to create and use rules to manage access to your CDN POPs. If an unauthorized request matches the rules, the CDN POP rejects the request and returns a 4xx status code. In this case, CPU resources are consumed when the POP handles the request. Traffic and bandwidth resources are consumed when the POP returns a 4xx status code. Therefore, you are charged for the traffic and bandwidth resources. For more information about the billing of traffic consumed in ApsaraVideo VOD, see Billing of basic services.
Why is the HTTP 404 status code returned when I use an accelerated domain name to access ApsaraVideo VOD resources?
You requested an inaccessible URL. In this case, you are automatically redirected to the 404 Not Found page. A URL becomes inaccessible if the URL generation rules of the web page are changed, the web file is renamed or relocated, or a spelling error exists in the provided URL. When the web server receives a request for an inaccessible URL, it returns the 404 status code to notify the browser that the requested resource does not exist.
Make sure that the accelerated domain name that you specified is bound to the bucket in which the resources are stored. If multiple buckets exist in a region and only one bucket is bound to an accelerated domain name, the system preferentially returns the CDN URL if you access resources in other buckets in the same region. In this case, the HTTP 404 status code is returned.
How do I determine whether the location of an error is on an Alibaba Cloud CDN POP or the origin server?
Visit http://tool.alikunlun.com/doc.html and check whether the local network is accessible.
Add a binding entry to your hosts file on your local PC for testing. If an error occurs when you access the origin server, the origin server is faulty. Contact the site administrator to resolve the issue.
Ping the accelerated domain name. If the ping operation is successful, the POP works as expected.
Why is content delivery outside the Chinese mainland not accelerated after I enable global acceleration?
Perform the following steps to troubleshoot the issue:
Check the IP address resolved by the domain name when a user outside the Chinese mainland accesses a domain name and determine whether the configurations of the POPs outside the Chinese mainland take effect.
Check whether the POPs outside the Chinese mainland are frequently visited. After the configurations of the POPs outside the Chinese mainland take effect, the access speed can be increased only when the POPs outside the Chinese mainland are frequently visited. If the POPs outside the Chinese mainland are not frequently visited, only a small number of requests can hit the cache. In this case, increasing the number of POPs outside the Chinese mainland cannot significantly increase the access speed of users outside the Chinese mainland.
What do I do if MP4 videos cannot be previewed after I enable the preview feature for the accelerated domain name in ApsaraVideo VOD?
ApsaraVideo VOD allows you to preview video files in the MP4 and HLS formats. The metadata of MP4 files must be contained in the file header. MP4 files whose metadata is contained in the file tail cannot be previewed. When ApsaraVideo VOD transcodes a video and converts its container format to MP4, the system places the metadata in the file header. If an MP4 video cannot be previewed, transcode the MP4 file. For more information about transcoding, see Audio and video transcoding.
Does ApsaraVideo VOD support the acceleration of wildcard domain names?
No. Wildcard domain names such as *.aliyundoc.com are not supported.
Why does the error message "The root domain is already used by another Alibaba Cloud account" appear the first time that a domain name is added to ApsaraVideo VOD?
If you fail to add a domain name to accelerate in the ApsaraVideo VOD console and the error message The root name of your domain is reserved by other account, please contact our Business Advisors appears, the root domain is already added to Alibaba Cloud CDN, Dynamic Content Delivery Network (DCDN), or ApsaraVideo VOD in another Alibaba Cloud account.
To request technical support from Alibaba Cloud, submit a ticket. For more information about how to submit a ticket, see Contact us.
What do I do if the "This domain name is exist already" error message appears when I add a domain name to ApsaraVideo VOD?
If the This domain name is exist already error message appears, the domain name fails to be added to ApsaraVideo VOD because the domain name has been added to another Alibaba Cloud service.
The domain name that you add to ApsaraVideo VOD must be exclusive for ApsaraVideo VOD. If the preceding error message appears, check whether the domain name is added to other cloud services such as ApsaraVideo Live, DCDN, Secure CDN (SCDN), or Video Surveillance System.
To request technical support from Alibaba Cloud, submit a ticket. For more information about how to submit a ticket, see Contact us.
How do I check whether a CNAME record takes effect?
- Windows On your on-premises computer, run the following commands:
- nslookup Domain name
- nslookup -qt=CNAME CNAME
- nslookup -qt=CNAME CNAME Domain name
The following result indicates that the CNAME record takes effect.
- Linux Use the telnet command to log on to the origin server, and run the following commands:
- dig Domain name
- dig CNAME CNAME
- dig CNAME CNAME @Domain name
The following result indicates that the CNAME record takes effect.
What do I do if the domain name I add to accelerate fails the review?
Content served on all accelerated domain names that are added to ApsaraVideo VOD must be reviewed. If the review request for your domain name is rejected, your domain name may not meet the relevant compliance requirements. For more information about the requirements and limits for domain names, see Domain name requirements.
If the review request for your domain name is rejected, you can perform the following steps to check the reason: Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Configuration Management > CDN Configuration> Domain Names. On the page that appears, view the rejection reason. Then, you can modify the content and submit the domain name for review again.
How do I troubleshoot a low cache hit ratio?
If all requests are directed to the origin server, the cache hit ratio is extremely low. Unstable network conditions may also result in a lower cache hit ratio. To improve the cache hit ratio, you can prefetch URLs, configure resource cache rules, and filter out the variable parameters in URLs.
The following table describes the methods that you can use to improve the cache hit ratio.
Method | Cause and use scenario | References |
Prefetch resources during off-peak hours | Cause: Before a major event is launched or an installation package is released, required resources are not prefetched to POPs. The required resources must be retrieved from the origin server. This reduces the cache hit ratio. Scenario:
| |
Specify a proper time-to-live (TTL) value for cached resources | Cause:
Scenario: Static resources are stored on the origin server but not cached on POPs. The resources cached on POPs frequently expire. Recommended configuration:
| |
Ignore the parameters after the question mark (?) in URLs | Cause: If request URLs contain queryString or other variables, the URLs are considered different even if the URLs are used to access the same resource. In this case, the requests are redirected to the origin server. This reduces the cache hit ratio. Scenario: Redirect URLs that contain different query strings to the same resource. | |
Configure a policy to retrieve chunks of the resource file from the origin server | Cause: Downloads of installation packages or video streaming may be paused due to various reasons. In some cases, users require only a chunk of a file, but POPs return the entire file. The size of the content returned to the users is larger than that of the content requested by the users. In this case, the cache hit ratio is lower than the expected ratio. Scenario: Download installation packages or watch videos. |
What do I do if access speed is low after I configure an accelerated domain name in ApsaraVideo VOD?
Alibaba Cloud CDN adds POPs to the existing network and caches resources retrieved from the origin server to the POPs closest to the requesters. When the resources are requested again, Alibaba Cloud CDN returns the resources directly from the cache instead of retrieving them from the origin server. This helps improve the access speed of the website. The following items describe the possible causes behind the low access speed:
Network issues occur on the client, such as insufficient downstream bandwidth and configuration errors.
Network connection between the client and the POP is poor and access latency is high.
An error occurs on the POP and the response speed is low.
The size of the resource is large and the resource requires a longer period of time to be downloaded.
The back-to-origin network condition is poor.
The response speed of the origin server is low.
Why does the error message "The 'Access-Control-Allow-Origin' header has a value 'xxx' that is not equal to the supplied origin" appear when users request resources?
The The 'Access-Control-Allow-Origin' header has a value 'xxx' that is not equal to the supplied origin error message is returned when you request resources. The following figure shows the returned error. 
This is because Access-Control-Allow-Origin header that Alibaba Cloud CDN returned is different from the Origin header in the request. In this case, the browser does not respond to the request. For example, if the Origin header in the request is "Origin:http://Domain name A" and the Access-Control-Allow-Origin header returned by Alibaba Cloud CDN is "Access-Control-Allow-Origin:http://domain name B", the browser does not respond to the request.
This following items describe the causes of this issue:
The cross-origin header that you configured in Alibaba Cloud CDN is different from that of the Origin header in the request.
The cross-origin header that you configured on the origin server is overwritten by the cross-origin header that you configured in Alibaba Cloud CDN.
The browser cache is not cleared.
I bind a domain name to a bucket in ApsaraVideo VOD, Why is an HTTPS URL not returned in the callback after transcoding is complete?
ApsaraVideo VOD does not support HTTPS callbacks. If you have correctly configured the SSL certificate in ApsaraVideo VOD, you can replace HTTP in the URL with HTTPS in the returned callback.
The callbacks related to snapshots and thumbnails include HTTPS URLs. The callbacks related to transcoding include HTTP URLs.
How do I update files with the same name after I configure an accelerated domain name?
You can use the ApsaraVideo VOD console or call an API operation to update files. For more information, see Refresh and prefetch. You can submit a maximum of 2,000 refresh requests per day. Each request can contain a maximum of 1,000 URLs. Directory refresh is supported. You can submit a maximum of 100 directory refresh requests per day. For more information about the API operations that you can call to update files, see Refresh and prefetch.
What do I do if the resources are not updated after I use the refresh or prefetch feature?
You can perform the following operations to troubleshoot the issue:
Clear the browser cache and refresh the web page.
Bind the domain name to the origin server by changing the local host. Check whether the resources on the origin server are updated. If the resources are not updated, update the resources on the origin server and then use Alibaba Cloud CDN to accelerate content delivery.
Log on to the ApsaraVideo VOD console and check whether the refresh or prefetch task is complete. If the task is not complete, we recommend that you run the task again.
How do I block malicious requests from specific IP addresses?
You can configure an IP address blacklist. The IP addresses in the IP address blacklist are blocked and cannot access resources in ApsaraVideo VOD. For more information, see IP address blacklist or whitelist.
What do I do if an IP address in the blacklist can still access resources in ApsaraVideo VOD?
Check whether the IP address that you specified in the IP address blacklist is correct. If you want to control access from specific client IP addresses, you must add the X-Forwarded-For (XFF) header to the IP whitelist or blacklist. For more information about how to obtain the XFF header, see Retrieve the originating IP addresses of clients.
Alibaba Cloud CDN cannot restrict client-side requests. After you add an IP address to the IP blacklist, requests sent from this IP address receive the HTTP 403 status code. You can check the log entries generated by the requests. For more information about how to view logs, see Download logs.
If the HTTP 403 status code is returned to a client request, you are charged for the network traffic generated during this process. In this process, network traffic is generated by only the response header. Therefore, you are charged for only a small amount of network traffic. For more information, see the Am I charged if the requested Alibaba Cloud CDN POP returns a 4xx status code? section of this topic.
What do I do if the HTTP 403 status code is returned due to hotlinking issues when I access resources in ApsaraVideo VOD by using an accelerated domain name?
Problem description
After you configure hotlinking protection, the HTTP 403 status code is returned when you access resources in ApsaraVideo VOD by using an accelerated domain name.
Cause
The hotlinking protection setting is invalid or an empty Referer is set.
Solution
Locate the issue.
Run the curl command to check whether the accelerated domain name can be accessed. Sample code:
curl -voa -e "http://demo.aliyundoc.com" http://example.aliyundoc.comA command output similar to the following figure is displayed. The Referer field in the HTTP request header is demo.aliyundoc.com, the HTTP 403 status code is returned, and the error message "denied by Referer ACL" appears. This indicates that the hotlinking protection setting is invalid.
Run the curl command to check whether the accelerated domain name can be accessed. Sample code:
curl -voa http://example.aliyundoc.comA command output similar to the following figure is displayed. The HTTP request header does not include the Referer field, the HTTP 403 status code is returned, and the error message "denied by Referer ACL" appears. This indicates that the Referer is empty.
Visit an accelerated URL in Chrome and open the developer tools. If the content shown in the following figure appears, the HTTP request header information does not include the Referer field. This indicates that the Referer is empty.
Solve the issue based on the cause.
Perform the following operations if the hotlinking protection setting is invalid:
Check whether the hotlinking protection setting of demo.aliyundoc.com is the same as that of the accelerated domain name example.aliyundoc.com.
Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Configuration Management > CDN Configuration > Domain Names. On the page that appears, find the domain name that you want to manage and click Configure in the Actions column. On the page that appears, click Resource Access Control. On the Referer-based Anti-Leech tab, click Modify. In the dialog box that appears, set Method to Whitelist. If the hotlinking protection setting does not match the Referer, add demo.aliyundoc.com to the Referer whitelist.
Perform the following operations if the Referer is empty:
Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Configuration Management > CDN Configuration > Domain Names. On the page that appears, find the domain name that you want to manage and click Configure in the Actions column. On the page that appears, click Resource Access Control. On the Referer-based Anti-Leech tab, click Modify. In the dialog box that appears, select Allow Access to Resource URL from Browser Address Bar.
NoteIf you select Allow Access to Resource URL from Browser Address Bar, your resources are exposed to risks of hotlinking.