0

I have a few EB instances running with the default settings, but even though they're barely doing anything at the moment (literally just running static holding pages with no visitors), they keep falling into moments of Severe health problems.

Why is this? Should I be concerned? Again, they're configured using the default EB settings.

enter image description here

UPDATE

Here's the access logs. They support the @bazze's supposition that EB healthcheck is looking at several common uRLs as a test, and gets 404 as reply:

[26/Nov/2017:17:09:46 +0000] "GET / HTTP/1.1" 200 2422 "-" "ELB-HealthChecker/1.0" 
[26/Nov/2017:17:09:46 +0000] "HEAD /sql/sql-admin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:47 +0000] "HEAD /sql/phpmyadmin2/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:47 +0000] "HEAD /sql/phpMyAdmin2/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:47 +0000] "HEAD /sql/phpMyAdmin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:47 +0000] "HEAD /db/myadmin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:48 +0000] "HEAD /db/webadmin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee"         
[26/Nov/2017:17:09:48 +0000] "HEAD /db/dbweb/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:48 +0000] "HEAD /db/websql/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:48 +0000] "HEAD /db/webdb/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:49 +0000] "HEAD /db/dbadmin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:49 +0000] "GET / HTTP/1.1" 200 2422 "-" "ELB-HealthChecker/1.0" 
[26/Nov/2017:17:09:49 +0000] "HEAD /db/db-admin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:49 +0000] "HEAD /db/phpmyadmin3/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:49 +0000] "HEAD /db/phpMyAdmin3/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:50 +0000] "HEAD /db/phpMyAdmin-3/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:50 +0000] "HEAD /administrator/phpmyadmin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:50 +0000] "HEAD /administrator/phpMyAdmin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:51 +0000] "HEAD /administrator/db/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:51 +0000] "HEAD /administrator/web/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:51 +0000] "HEAD /administrator/pma/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:51 +0000] "HEAD /administrator/PMA/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:52 +0000] "HEAD /administrator/admin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:52 +0000] "HEAD /phpMyAdmin2/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:52 +0000] "HEAD /phpMyAdmin3/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:52 +0000] "HEAD /phpMyAdmin4/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:53 +0000] "HEAD /phpMyAdmin-3/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee" 
[26/Nov/2017:17:09:53 +0000] "HEAD /php-my-admin/ HTTP/1.1" 404 - "-" "Mozilla/5.0 Jorgee"
| improve this question | |
  • What do your application logs say about the failed health checks? – jordanm Oct 11 '17 at 15:47
4

You can see the reason in the event details. It says that 100% of the requests are failing with a 4XX status code. So my guess is that, based on the info in your question that these sites are basically idling and not being used, you are just getting a visit from a bot from time to time looking for common directories and files to find something to hack. Checking the access logs you can quickly confirm if this is the case.

Update: When Enhanced Health Reporting is enabled for an EB environment, and no operation is in progress, the HTTP requests are the primary source of the environment's health. Read more about it in the docs.

| improve this answer | |
  • 1
    Interesting. I'd have thought this was the ELB health checker getting 4xx errors, not the general public. – ceejayoz Oct 11 '17 at 20:46
  • @ceejayoz Same here. I'm fairly certain this is an AWS environment health check, not direct analytics from visitors, but I could be wrong. – Django Reinhardt Oct 12 '17 at 14:54
  • Well, EB use the actual HTTP requests to your service in order to determine health. If you serve a lot of 4XX or 5XX responses, the application status will show as degraded if the percentage of these requests reach certain limits. This is actually the primary source for the environment health, as stated in the docs: docs.aws.amazon.com/elasticbeanstalk/latest/dg/… – Bazze Oct 12 '17 at 14:59
  • @Bazze Checked the logs, you were absolutely right. – Django Reinhardt Nov 27 '17 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.