Run comprehensive diagnostics on an ECS instance's system, network, and disk to identify and resolve common issues.
Prerequisites
-
The Instance Fee and Security Behavior Audit diagnosis requires the AliyunServiceRoleForECSSelfService service-linked role. If the role does not exist, a prompt appears to create it automatically.
This role includes the AliyunServiceRolePolicyForECSSelfService system access policy. You cannot add, modify, or delete the permissions granted by this policy.
If you use a RAM user to run Instance Fee and Security Behavior Audit diagnostics, the Alibaba Cloud account owner must grant the RAM user permission to create service-linked roles. See Create custom policies in edit mode and Grant permissions to a RAM user.
The following policy grants a RAM user permission to use self-service instance troubleshooting. Replace <account ID> with your Alibaba Cloud account UID.
{ "Statement": [ { "Action": [ "ram:CreateServiceLinkedRole" ], "Resource": "acs:ram:*:<account ID>:role/*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": [ "selfservice.ecs.aliyuncs.com" ] } } } ], "Version": "1" } -
For comprehensive diagnosis or network anomaly diagnosis, the instance must meet the following conditions:
-
Instance type: The instance belongs to a purchasable instance family. See Instance families.
nullDiscontinued instance families do not support the instance health diagnosis feature.
-
Instance status: The instance is in the Running state.
-
Operating system: If the diagnosis involves checking OS-level configurations, the operating system must meet the conditions in the following table.
System architecture
Operating system version
Configuration within the operating system
x86 64-bit
-
Windows Server 2008 and later
-
Alibaba Cloud Linux 2/3
-
AlmaLinux 8.x and later
-
Anolis OS 7.x/8.x
-
CentOS 7.x/8.x
-
CentOS Stream 8 and later
-
Debian 8.x and later
-
Fedora 33/34
-
OpenSUSE 15.x/42.x
-
Rocky Linux 8.x and later
-
SUSE Linux Enterprise Server 12.x/15.x
-
Ubuntu 16.04/18.04/20.04/24.04
-
Python version: Python 3.6 or later
-
The Cloud Assistant Agent is installed. See Install the Cloud Assistant Agent.
nullDistributions not listed in the table are unsupported. Diagnostic performance on unsupported distributions is not guaranteed.
-
-
-
For the Instance fails to start scenario, the instance must meet the following conditions:
-
Instance status: The instance is in the Stopped state.
-
Operating system: The diagnosis involves checking OS-level configurations. The operating system must meet the conditions in the following table.
System architecture
Operating system version
x86 64-bit
-
Windows Server 2008 and later
-
Alibaba Cloud Linux 2/3
-
AlmaLinux 8.x and later
-
Anolis OS 7.x/8.x
-
CentOS 7.x/8.x
-
CentOS Stream 8 and later
-
Debian 8.x and later
-
Fedora 33/34
-
OpenSUSE 15.x/42.x
-
Rocky Linux 8.x and later
-
SUSE Linux Enterprise Server 12.x/15.x
-
Ubuntu 16.04/18.04/20.04/24.04
nullDistributions not listed in the table are unsupported. Diagnostic performance on unsupported distributions is not guaranteed.
-
-
Use cases
Use comprehensive instance diagnosis in the following scenarios:
-
Troubleshoot issues: Run targeted diagnostics for specific problems, such as a failed network connection.
-
Perform regular checks: Monitor overall instance health during routine O&M to detect and resolve issues before they cause business disruptions.
Each diagnostic item includes a problem description and recommended solution. See Diagnostic items and results.
Procedure
Console
Create a diagnostic task
Log in to the ECS console.
-
In the navigation pane on the left, choose .
-
In the upper-left corner of the top menu bar, select a region.
-
Select a time range and an instance ID, and then click Start.
nullOnly one diagnostic task can run per instance at a time. The interval between two consecutive diagnoses must exceed 5 minutes.
Problem type
Description
Instance Performance Issues
Diagnose high CPU load, high memory usage, high bandwidth usage, high disk BPS or IOPS, or degraded performance.
Instance Connection Errors or Startup Exceptions
Diagnose failed SSH or VNC remote connections, instance down, or OS startup failures.
Network Issues
Diagnose degraded network performance or ping failures.
Ineffective Instance Operation
Diagnose operations that did not take effect, such as an unapplied disk expansion.
Insufficient Resource Quota
Diagnose quota-related issues, such as insufficient disk capacity quota, image quota, or exceeding the maximum number of elastic network interfaces (ENIs) or security groups.
Check for Security Risks
Diagnose security risks such as system vulnerabilities, security alerts, or malicious processes.
Instance Billing and Security Audit
Audit operations related to instance status, instance fees, and security groups.
nullThis feature requires the service-linked role and permissions for self-service instance troubleshooting. See Service-linked role AliyunServiceRoleForECSSelfService.
Instance Device Check
Check whether devices such as GPUs on an instance are running properly.
Others
Enter the issue details, instance ID, and the corresponding troubleshooting epoch directly.
Actual diagnostic items may vary. In the diagnostic report, click the tabs under Diagnostic Item Details to view the items and progress. You can monitor progress on the current page or close the dialog box and check the diagnostic task list later.
-
View the diagnostic report.
The diagnostic report contains the following information:
-
Basic Information: Diagnosis time range, resource ID, report ID, and diagnosis time.
-
Diagnosis Result: If all checks pass, the result is No exceptions are detected on the instance. If abnormal items are found, specific items and recommended solutions are displayed.
-
Diagnostic Item Details: Results for each diagnostic item, with severity levels of Critical, Warning, and Passed.
nullWith instance fee and security behavior audit, you can also obtain more information:
-
Query more audit information in the ActionTrail console.
-
Query billing information in Billing Details.
Use the diagnostic report to resolve issues.
-
For common issues, see Common issues and solutions for the guest OS of an ECS instance.
-
For instance startup failures, log on to the ECS instance and use the attached repair disk to fix the issue.
-
View diagnostic history
Review the historical health status of an instance through its diagnostic history.
Log in to the ECS console.
-
View the instance's diagnostic history.
-
In the navigation pane on the left, choose .
-
In the top navigation bar, select a region.
-
On the Instance Troubleshooting tab, click View History.
-
On the Check History page, click the Instance Health Diagnosis tab, enter a resource ID or report ID, and then click the
icon.
nullIn the diagnostic history report list, you can click the
icon to the left of Actions and select a status to filter the list. -
-
For a single diagnostic history entry, click View Report to view the detailed report, or click Re-diagnose to start a new diagnosis.
API
-
Query diagnostic metrics.
Call DescribeDiagnosticMetrics to query diagnostic metrics. For available diagnostic metrics, see Diagnostic items and results.
-
Manage diagnostic metric collections.
Two types of diagnostic metric collections are available for creating diagnostic reports.
-
Public diagnostic metric collections: Based on common user issues, these simplify the diagnosis process.
Public diagnostic metric collections are maintained by Alibaba Cloud and cannot be modified. Call DescribeDiagnosticMetricSets to query them. The supported public diagnostic metric collections are as follows.
Metric name
Description
Scenario
dms-instancedefault
Default diagnostic collection
Comprehensive check of an ECS instance.
-
Custom diagnostic metric collections: To check only specific metrics, call CreateDiagnosticMetricSet to create a custom collection. After creation, call DescribeDiagnosticMetricSets to query it.
The following sample response shows a custom diagnostic metric collection named test.
{ "RequestId": "6AF68D67-601A-5278-AB10-4195CCA7****", "MetricSets": [ { "Type": "User", "MetricIds": [ "Instance.ControllerError", "Instance.CPUException", "Instance.CPUSplitLock" ], "MetricSetId": "dms-uf6ck3iljpbft15i****", "ResourceType": "instance", "MetricSetName": "test" } ] }
-
-
Create a diagnostic report.
Call CreateDiagnosticReport to create a diagnostic report with a custom or public diagnostic metric collection.
The following sample response shows a successfully created diagnostic report.
{ "RequestId": "A1283ACE-2F19-54B9-9464-401EBD1A****", "ReportId": "dr-uf6aacg5g2fjp64i****" } -
Query a diagnostic report.
Call DescribeDiagnosticReports to query diagnostic report details. The response returns the diagnosis result for each metric in the collection. See Diagnostic items and results.
The following sample response shows a normal diagnosis with no issues found.
{ "RequestId": "20381C19-C31B-52AE-AC9B-8AD672E4****", "NextToken": "", "Reports": [ { "Status": "Finished", "EndTime": "2022-09-07T15:36Z", "ResourceId": "i-uf653eye7pkftni****", "MetricSetId": "dms-uf6ck3iljpbft15i****", "Issues": [], "StartTime": "2022-09-05T15:36Z", "CreationTime": "2022-09-07T15:36Z", "ReportId": "dr-uf6aacg5g2fjp64i****", "ResourceType": "instance", "Severity": "Normal", "FinishedTime": "2022-09-07T15:36Z" } ] }
References
-
DescribeDiagnosticMetrics - Query a list of diagnostic metrics.
-
DescribeDiagnosticReportAttributes - Query the details of a resource diagnostic report.
-
DeleteDiagnosticReports - Delete resource diagnostic reports.
-
ModifyDiagnosticMetricSet - Modify a resource diagnostic metric collection.
-
DeleteDiagnosticMetricSets - Delete resource diagnostic metric collections.