Elastic Load Balance. User Guide. Issue 01 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 Issue 01 Date HUAWEI TECHNOLOGIES CO., LTD.

2 2018. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China support@huawei.com i

3 Contents Contents 1 Product Description What Is Elastic Load Balance? Load Balancer Type Components Functions Advantages Related Services Application Scenarios Getting Started Configuration Process Creating a Classic Load Balancer Creating an Enhanced Load Balancer Management Load Balancer Listener Whitelist Backend ECS Certificate Monitoring ELB Metrics Setting Alarm Rules Viewing ELB Metrics Audit Operations Recorded by CTS Viewing Audit Logs Best Practices Enhanced Load Balancer Classic Load Balancer FAQs Can I Adjust the Bandwidth of a Load Balancer? What Load Balancing Algorithms Does ELB Support?...51 ii

4 Contents 7.3 Does ELB Support ECSs Running Different OSs? How Many Load Balancers Can I Have? How Can ELB Support Multiple Certificates? How Can I Configure a Public or Private Network Load Balancer? What Functions Do Listeners Provide? What Is the Relationship Between the Load Balancing Algorithms and Sticky Session Types? What Are Protocols and Frontend Ports? What Are ECS Protocols and Ports? Is the EIP Assigned to the ELB Service Exclusively Used? What Is the Impact of Deleting a Load Balancer? How Do I Rectify a Health Check Failure? How Can I Obtain the Real IP Address of a Visitor? What Types of Sticky Sessions Does ELB Support? Appendix Configure the TOA Plug-in Change History iii

5 1 Product Description 1 Product Description 1.1 What Is Elastic Load Balance? Elastic Load Balance (ELB) is a service that distributes incoming application traffic across multiple Elastic Cloud Servers (ECSs) based on the forwarding policies. This improves the fault tolerance and increases the availability of your applications. With ELB, you can create a load balancer, configure the listening ports, and add backend ECSs to the load balancer. You can also check the running state of backend ECSs to ensure that requests are sent to healthy ECSs. 1.2 Load Balancer Type Classic Load Balancer Enhanced Load Balancer ELB provides two types of load balancers: enhanced load balancer and classic load balancer. You can select an appropriate type based on application scenarios and requirements. Both types of load balancers can be Internet-facing or internal. Classic load balancers are applicable to web services with low access traffic and simple application models. Enhanced load balancers are applicable to web services with high access traffic. They forward the requests based on the domain name or URL, making request routing more flexible. Compared with classic load balancers, enhanced load balancers provide comprehensive Layer 7 load balancing capabilities and more powerful forwarding performance. Differences Application Scenarios Enhanced load balancers forward the requests based on the domain name or URL, making request routing more flexible. Therefore, they are applicable to web services with high access traffic. Compared with classic load balancers, enhanced load balancers 1

6 1 Product Description provide comprehensive Layer 7 load balancing capabilities and more powerful forwarding performance. Classic load balancers are applicable to web services with low access traffic and simple application models. Performance Table 1-1 lists the functions supported by enhanced load balancers and classic load balancers. Table 1-1 Function comparison Function Classic Load Balancer Enhanced Load Balancer Internet-facing and internal load balancing Load balancing at Layer 4 and Layer 7 Load balancing algorithm (round robin, least connections, and source IP hash) Supported Supported Supported Supported UDP not supported Supported Sticky session Supported Supported WebSocket protocol Supported Supported HTTP/2 protocol Not supported Supported ECSs as backend servers Supported Supported Access control (whitelist) Not supported Supported Standard OpenStack APIs Not supported Supported 1.3 Components ELB consists of the following components: Load balancer A load balancer serves as a single point of contact for clients. It accepts incoming traffic from clients and routes requests to its backend ECSs in one or more Availability Zones (AZs). It also monitors the health of backend ECSs and ensures that it routes the traffic only to healthy ECSs. To use ELB, you must first create a load balancer and add at least one listener and backend ECS to the load balancer. Listener After creating a load balancer, you need to add a listener to the load balancer. The listener is configured with a protocol and port number for connections from clients to the load balancer. Backend ECS 2

7 1 Product Description 1.4 Functions Classic Load Balancer At least one ECS must be added to the load balancer to receive the requests forwarded by the listener. Protocol Compliance Classic load balancers support the following protocols: TCP and UDP at Layer 4, and HTTP and HTTPS at Layer 7. Health Check The health check is to monitor the running state of backend ECSs so that load balancer sends requests only to the ECSs that are running properly. After a faulty ECS is restored, the load balancer will send requests to this ECS again. The health check protocols include TCP, UDP, and HTTP. Sticky Session Enhanced Load Balancer 1.5 Advantages After the sticky session feature is enabled, the load balancer route requests in one session to the same backend ECS for processing. Load Balancing Algorithm The following algorithms are supported: Round robin: Each connection request is forwarded to the next ECS in sequence so that all requests are distributed evenly to all ECSs. Least connections: New connection requests are forwarded to the ECS processing the least connections. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. Certificate Management ELB allows you to manage HTTPS certificates. You do not need to upload the certificates the backend ECSs. Enhanced load balancers also provide the following extra functions: Domain Name and URL Matching For Layer-7 load balancing (only HTTP is supported for now), requests can be forwarded to different backend cloud host groups based on the domain name and URL Access Control A whitelist can be added to allow specified IP addresses to access the load balancers. ECS Weight Assigning Both types of load balancers have the following advantages: high Performance 3

8 1 Product Description ELB can process up to 100 million concurrent connections. This makes ELB capable of handling massive access requests. High Availability ELB is deployed in cluster mode and can distribute incoming application traffic across multiple ECSs in multiple AZs. Flexible Expansion Incoming traffic is intelligently distributed to ECSs. ELB can work with Auto Scaling (AS) to flexibly expand the service capabilities of your applications. Easy to Use ELB can be quickly deployed, and diverse protocols and algorithms are available, enabling you to easily configure load distribution policies for different scenarios. Enhanced load balancers also feature the following: Reliability Both Internet-facing and internal load balancers support cross-az load balancing, the SLA level reaches 99.99%. The consistent hashing algorithm makes the traffic distribution more balanced. Easy O&M 1.6 Related Services ELB allows you to monitor your applications and their performance in real time with Cloud Eye metrics at the granularity of an individual listener. Virtual Private Cloud (VPC) ELB requires elastic IP addresses and bandwidth assigned in the VPC service. Auto Scaling (AS) ELB can work with AS to automatically add backend ECSs to or remove backend ECSs from the load balancer. Identity and Access Management (IAM) ELB requires authentication provided by IAM. Cloud Trace Service (CTS) CTS records the resource operations performed on ELB resources. Cloud Eye 1.7 Application Scenarios After you have enabled ELB, you can use Cloud Eye to view the status of monitored objects, without requiring additional plug-ins to be installed. High Traffic Services For services with high volume of traffic, such as large portals and mobile application stores, ELB evenly distributes the access traffic to multiple backend ECSs. The sticky session feature ensures that requests from the same client are forwarded to the same backend ECS, improving the access efficiency. Services with Significant Traffic Peaks 4

9 1 Product Description ELB automatically scales its request handling capacity according to the incoming traffic. Deep integration with AS enables ELB to automatically add or remove backend ECSs, improving the service flexibility. This makes ELB ideal for services that have significant traffic peaks, such as e-commerce websites, mobile games, and live websites. SPOF Elimination ELB routinely performs health checks backend ECSs to monitor their healthy state. If a backend ECS becomes faulty, ELB automatically distributes incoming requests to healthy backend ECSs, ensuring the service continuity. This makes ELB the right choice for services that require high reliability, such as official websites, toll collection systems, and common web services. Cross-AZ Load Balancing ELB can distribute traffic across AZs. If an AZ becomes faulty, ELB distributes the traffic to backend ECSs in other AZs that are running properly. Banking, policing, and large application systems can use ELB to ensure high service availability. 5

10 2 Getting Started 2 Getting Started 2.1 Configuration Process When using ELB to distribute the incoming traffic to multiple backend ECSs, you need to create a load balancer, add a listener to the load balancer, configure the health check, and add backend ECSs to the listener. Figure 2-1 shows the configuration process. 6

11 2 Getting Started Figure 2-1 Configuration flowchart 2.2 Creating a Classic Load Balancer Scenarios This section describes how to quickly create a classic load balancer. Prepare for Creation Select the network type of the load balancer. Public network (Internet-facing) A public network load balancer provides load balancing services through the public IP address, and routes requests from the clients to backend ECSs over the Internet. Private network (internal) A private network load balancer provides load balancing services through the private IP address, and routes requests from the clients to backend ECSs in a VPC. Select the protocol. 7

12 2 Getting Started Protocol Description Application Scenarios Layer 4 TCP Source IP address based sticky sessions Fast data transfer Layer 4 UDP Low reliability Fast data transfer Layer 7 HTTP Cookie-based sticky sessions X-Forward-For request header Scenarios that require high reliability and data accuracy, such as file transfer, sending and receiving, and remote login Web applications that feature a number of concurrent connections and require high performance Scenarios that focus on timeliness rather than reliability, such as video chat, game, and real-time financial market information push Applications in which the data content needs to be identified, such as web applications and mobile games Layer 7 HTTP S An extension of HTTP for encrypted data transmission that can prevent unauthorized access SSL offloading Encryption and decryption are performed on the load balancer to reduce the work load of backend ECSs. Multiple encryption protocols and cipher suites Applications that require encrypted transmission Select the load balancing algorithm. Create a Classic Load Balancer Round robin: Each connection request is forwarded to the next ECS in sequence so that all requests are distributed evenly to all ECSs. Least connections: New connection requests are forwarded to the ECS processing the least connections. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 8

13 2 Getting Started 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, click Create Classic Load Balancer and specify the parameters by referring to Table 2-1. Table 2-1 Load balancer parameters Parameter Description Example Value Name Specifies the load balancer name. elb_01 Type VPC AZ EIP Specifies the load balancer type. You can select Public network or Private network. Public network: A public network load balancer the routes requests from the clients to backend ECSs over the Internet. Private network: A private network load balancer routes the requests from the clients to backend ECSs in a VPC. Specifies the VPC to which the load balancer belongs. You can select an existing VPC or click View VPC to create one. For more information about VPC, see the Virtual Private Cloud. Specifies the AZ of a load balancer. This parameter is required when you select Private network for Type. Specifies the public IP address that will be bound to the load balancer for load balancing. This parameter is available when you select Public network for Type. Two options are available for you: New EIP: The system will assign a new EIP to the load balancer. Use existing: An existing IP address will be used. Private network VPC_01 AZ

14 2 Getting Started Parameter Description Example Value EIP Type EIP Subnet Virtual IP Address Virtual IP Address Security Group Billing Mode Bandwidth Description Specifies the link type (BGP) when a new EIP is used. Static BGP: When changes occur on a network using static BGP, carriers cannot adjust network configurations in real time to ensure optimal user experience. Dynamic BGP: When changes occur on a network using dynamic BGP, routing protocols provide automatic, real-time optimization of network configurations, ensuring network stability and optimal user experience. Asks you to select an EIP when you select Use existing for EIP. Specifies the subnet to which the load balancer belongs when you select Private network for Type. Specifies the virtual IP address (VIP) that will be bound to the load balancer. This parameter is available when you select Private network for Type. Two options are available: Automatically assign: The system will assign a VIP to the load balancer. Manually specify: You need to enter an IP address. Asks you to enter an IP address when you select Manually specify for Virtual IP Address. Specifies the security group to which the load balancer belongs. This parameter is available when you select Private network for Type. Specifies how you will be charged when applying for a new EIP. You can select Bandwidth or Traffic. Specifies the public network bandwidth in Mbit/s. Provides supplementary information about the load balancer. Dynamic BGP N/A N/A Automatically assign Manually specify N/A Bandwidth 100 N/A 5. Click Next. 6. After confirming the specifications, click Submit. 10

15 2 Getting Started Add a Listener After creating a load balancer, you must add a listener to this load balancer. Perform the following operations to add a listener: 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. In the Listeners area, click Add Listener. In the displayed Add Listener dialog box, specify the parameters by referring to Table 2-2. Table 2-2 Listener parameters Parameter Description Example Value Name Specifies the listener name. listener01 Load Balancing Protocol/Port ECS Protocol/Port Specifies the protocol and port used for load balancing. A public network load balancer supports the following protocols: HTTP: load balancing at Layer 7 TCP: load balancing at Layer 4 HTTPS: encrypted load balancing at Layer 7 UDP: load balancing at Layer 4 A private network load balancer supports the following protocols: HTTP: load balancing at Layer 7 TCP: load balancing at Layer 4 HTTPS: encrypted load balancing at Layer 7 Specifies the protocol and port used by backend ECSs. TCP/80 HTTP/80 HTTPS/443 TCP/22 11

16 2 Getting Started Parameter Description Example Value Load Balancing Algorithm Default Certificate Enable SNI SNI Certificate Specifies the algorithm that the load balancer uses for distributing the traffic. Round robin: Each connection request is forwarded to the next ECS in sequence so that all requests are distributed evenly to all ECSs. Least connections: New connection requests are forwarded to the ECS processing the least connections. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. Choose an appropriate algorithm to distribute the traffic and improve load balancing capabilities. Specifies the certificate used by an HTTPS load balancer. You can select an existing certificate or create one. For details about how to create a certificate, see section 3.5 Certificate. This parameter is available only when Load Balancing Protocol is set to HTTPS. Specifies whether to enable the Server Name Indication (SNI) function when Load Balancing Protocol is set to HTTPS. SNI is an extension to Transport Layer Security (TLS) when a server uses multiple domain names and certificates. This function allows the client to submit the domain name information when sending an SSL handshake request. After receiving the request, ELB queries the right certificate based on the domain name and returns the certificate to the client. If no certificate is found, ELB returns a default one. Specifies the certificate associated with the domain name when Load Balancing Protocol is set to HTTPS. You can select an existing certificate or click Create Certificate to create one. Round robin cert-miij/ e1b1 a4526b346cd fb9b9f856a N/A N/A 12

17 2 Getting Started Parameter Description Example Value SSL Protocol SSL Cipher Sticky Session Stickiness Duration (min) Check Mode Interval (s) Timeout (s) Specifies the SSL protocol used by an HTTPS load balancer. This parameter is used to enable a specified encryption protocol: TLSv1.2 TLSv1.2 TLSv1.1 TLSv1 This parameter is available only when Load Balancing Protocol is set to HTTPS. Specifies the SSL password used by an HTTPS load balancer. The following options are available: Default Cipher Extended Cipher Strict Cipher This parameter is available only when Load Balancing Protocol is set to HTTPS. Only Extended Cipher is available when SSL Protocol is set to TLSv1.2 TLSv1.1 TLSv1. Specifies whether to enable the sticky session feature. After the sticky session feature is enabled, the load balancer route requests in one session to the same backend ECS for processing. NOTE The sticky session feature is supported only when Load Balancing Mode is set to Round robin. Specifies the period of time that sticky sessions will be maintained. This parameter is available only when the sticky session feature is enabled. The parameter value ranges from 1 to Specifies the protocol and port used for performing health checks on ECSs. NOTE When UDP is used for health check, the security group rules of backend ECSs must allow access using the ICMP protocol. Specifies the maximum amount of time between health checks. Specifies the amount of time you need to wait when receiving a response from the health check. N/A N/A N/A 5 HTTP/

18 2 Getting Started Parameter Description Example Value Healthy Threshold Unhealthy Threshold Check Path Specifies the threshold at which the health check result is considered normal. It indicates the number of consecutive successful health checks necessary for a backend ECS to be considered healthy. Specifies the threshold at which the health check result is considered abnormal. It indicates the number of consecutive successful health checks necessary for a backend ECS to be considered unhealthy. Specifies the health check URL. This parameter is available only when Check Mode is set to HTTP. NOTE Special characters -/.%?#&= can be contained in the path. 3 3 /test.html Add Backend ECSs 6. Click OK. You must add backend ECSs in running state to your listener so that the load balancer can distribute the traffic to the ECSs. Perform the following operations to add backend ECSs: 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. In the Listeners area, locate the row that contains the target listener and click Add Backend ECS in the Operation column. 6. In the displayed Add Backend ECS dialog box, select the subnet and backend ECSs to be added. You can filter backend ECSs by their name or IP address. 7. Click OK. Delete a Load Balancer You can delete a load balancer if you do not need it any more. Perform the following operations to delete the listener. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 1. On the Elastic Load Balance page, locate the row that contains the target load balancer, click More the Operation column, and select Delete from the drop-down list. 14

19 2 Getting Started 2. In the displayed Delete Load Balancer dialog box, click OK. NOTE If the load balancer has listeners, delete the listeners before deleting the load balancer. 2.3 Creating an Enhanced Load Balancer Scenarios This section describes how to quickly create an enhanced load balancer. Prepare for Creation Select the protocol. Protocol Description Application Scenario Layer 4 TCP Source IP address based sticky sessions Fast data transfer Layer 7 HTTP Cookie-based sticky sessions X-Forward-For request header Layer 7 HTTPS Unified certificate management You can upload certificates to the load balancer. The decryption operations are performed on the load balancer to reduce the work load of backend ECSs. Multiple encryption protocols and cipher suites Scenarios that require high reliability and data accuracy, such as file transfer, sending and receiving, and remote login Web applications that feature a number of concurrent connections and require high performance Applications in which the data content needs to be identified, such as web applications and mobile games Applications that require encrypted transmission Select the load balancing algorithm. Weighted round robin: Connection requests are forwarded to backend ECSs in sequence based on the weight you have assigned so that all requests are evenly distributed to the ECSs. 15

20 2 Getting Started Create an Enhanced Load Balancer Weighted least connections: New connection requests are forwarded to the ECS processing the least connection requests, and the number of requests handled by this ECS depends on the assigned weight value. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, click Create Enhanced Load Balancer and specify the parameters based on Table 2-3. Table 2-3 Load balancer parameters Parameter Description Example Value Name Specifies the load balancer name. elb93wd VPC Subnet Virtual IP Address Virtual IP Address Specifies the VPC to which the load balancer belongs. You can select an existing VPC or click View VPC to create one. For more information about VPC, see the Virtual Private Cloud. Specifies the subnet to which the load balancer belongs. Specifies the IP address of the load balancer. You can select Automatically assign or Manually specify. If you select Manually specify, enter an IP address. Asks you enter an IP address for the load balancer if you select Manually specify for Virtual IP Address. vpc-4536 subnet-4536 Manually specify

21 2 Getting Started Parameter Description Example Value EIP EIP Type Billing Mode Public Network Bandwidth (Mbit/s) Description Specifies the public IP address that will be bound to the load balancer for routing the access requests received from clients over the Internet to multiple ECSs. The following options are available: Not required: No EIP will be bound to the load balancer. Therefore, the load balancer cannot receive requests from clients over the Internet. New EIP: The system will assign a new EIP. Use existing: An existing EIP will be bound to the load balancer. You need to select an EIP. Specifies the link type (BGP) when a new EIP is used. Static BGP: When changes occur on a network using static BGP, carriers cannot adjust network configurations in real time to ensure optimal user experience. Dynamic BGP: When changes occur on a network using dynamic BGP, routing protocols provide automatic, real-time optimization of network configurations, ensuring network stability and optimal user experience. Specifies how you will be charged when applying for a new EIP. You can select Bandwidth or Traffic. Specifies the public network bandwidth when a new EIP is used. Provides supplementary information about the load balancer. Use existing Dynamic BGP Bandwidth 100 N/A Add a Listener 5. Click Next. 6. Confirm the specifications and click Submit. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 17

22 2 Getting Started 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. In the Listeners area, click Add Listener. 6. In the displayed Add Listener dialog box, configure the parameters by referring to Table 2-4. When Protocol is set to HTTPS, a certificate must be deployed for the load balancer. Table 2-4 Load balancer parameters Item Parameter Description Example Value Listener Name Specifies the listener name. listener01 Protocol/ Frontend Port Specifies the protocol and port used for load balancing. The port value ranges from 1 to 65535, and the following protocols are available: HTTP: load balancing at Layer 7 TCP: load balancing at Layer 4 HTTPS: HTTPS-based load balancing HTTP/80 Backend Protocol Specifies the protocol and port used by backend ECSs. N/A Certificates Specifies the certificate to be used when the frontend protocol is HTTPS. - Description Provides supplementary information about the listener. N/A Backend ECS group Backend ECS Group Specifies a group of backend ECSs that have the same features. Create now Not required Create now 18

23 2 Getting Started Item Parameter Description Example Value Load Balancing Algorithm Specifies the algorithm that the load balancer uses for distributing the traffic. Weighted round robin: Connection requests are forwarded to backend ECSs in sequence based on the weight you have assigned so that all requests are evenly distributed to the ECSs. Weighted least connections: New connection requests are forwarded to the ECS processing the least connection requests, and the number of requests handled by this ECS depends on the assigned weight value. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. NOTE Choose an appropriate algorithm to distribute the traffic and improve load balancing capabilities. Weighted round robin 19

24 2 Getting Started Item Parameter Description Example Value Sticky Session Type Cookie Name Description After the sticky session feature is enabled, the load balancer route requests in one session to the same backend ECS for processing. Specifies the sticky session type. The following options are available: Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. HTTP cookie: The load balancer generates a cookie after it receives a request from a client. All the subsequent requests with the cookie are distributed to the same backend ECS for processing. App cookie: This type of sticky session relies on backend applications. All requests with the cookie generated by backend applications are distributed to the same backend ECS for processing. NOTE Only Source IP address is available when TCP is used as the frontend protocol. If HTTP or HTTPS is used as the frontend protocol, the sticky session type can be HTTP cookie or App cookie. Choose an appropriate sticky session type to distribute the access traffic and improve load balancing capabilities. Specifies the cookie name. When App cookie is selected, you need to enter a cookie name. Provides supplementary information about the backend ECS group. Source IP address cookie

25 2 Getting Started Item Parameter Description Example Value Health check Health Check Mode Specifies the protocol used for health check. The value can be TCP or HTTP and cannot be modified once it is set. HTTP Specifies the port used for health check. The value ranges from 1 to NOTE If no health check port is specified, the port of each backend ECS is used. 80 Interval (s) Specifies the maximum amount of time between health checks. 5 Timeout (s) Specifies the amount of time you need to wait when receiving a response from the health check. 10 Check Path Specifies the health check path, which is a URL. This parameter is required if Health Check Mode is set to HTTP. /index.html Maximum Retries Specifies the maximum number of retries for the health check. The value ranges from 1 to HTTP Method Specifies the HTTP request method. This parameter is required if Health Check Mode is set to HTTP. GET HTTP Status Code Specifies the returned status code for an HTTP. This parameter is required if Health Check Mode is set to HTTP or HTTPS Click OK. Add a Whitelist You can add a whitelist of specified IP addresses to control access to the listener. For detailed operations, see section 3.3 Whitelist. 21

26 2 Getting Started NOTICE Adding the whitelist may cause risks. Once the whitelist is set, only the IP addresses specified in the whitelist can access the listener. If access control is enabled but no whitelist is added, the listener cannot be accessed. Add Backend ECSs You must add backend ECSs in running state to your listener so that the load balancer can distribute the traffic to the ECSs. Perform the following operations to add backend ECSs: 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. Click Backend ECS Group, locate the row that contains the target listener, and click Add Backend ECS in the Operation column. 6. Enter the backend port number and select the backend ECSs to be added. You can filter backend ECSs by their name or private IP address. 7. Click OK. Bind an EIP to a Load Balancer You can bind an EIP to a load balancer to receive requests over the Internet. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. Locate the row that contains the target load balancer and click its name. 5. On the load balancer details page, click Bind following EIP and select the EIP to be bound from the drop-down list. 6. Click to bind the EIP to the load balancer. NOTE Delete a Load Balancer Click Unbind if you do not need this EIP. You can delete a load balancer if you do not need it any more. Perform the following operations to delete the listener. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 22

27 2 Getting Started 1. On the Elastic Load Balance page, click Delete in the Operation column. 2. In the displayed Delete Load Balancer dialog box, click OK. NOTE If the load balancer has listeners, delete the listeners before deleting the load balancer. 23

28 3 Management 3 Management 3.1 Load Balancer Overview A load balancer serves as a single point of contact for clients. To load balance, you must create a load balancer and add at least a listener and backend ECS to the load balancer. ELB provides two types of load balancers: enhanced load balancer and classic load balancer. You can select an appropriate type based on application scenarios and requirements. For details about how to create a classic load balancer, see section 2.2 Creating a Classic Load Balancer. For details about how to create an enhanced load balancer, see section 2.3 Creating an Enhanced Load Balancer. Internet-facing Load Balancer A public network load balancer provides load balancing services through the public IP address, and routes requests from the clients to backend ECSs over the Internet. 24

29 3 Management Figure 3-1 Internet-facing load balancer Internal Load Balancer A private network load balancer provides load balancing services through the private IP address, and routes requests from the clients to backend ECSs in a VPC. 25

30 3 Management Figure 3-2 Internal load balancer 3.2 Listener Scenarios After creating a load balancer, you need to add at least one listener to the load balancer. A listener is a process that checks for connection requests using the protocol and port number for connections from clients to the load balancer. The listener defines the health check configuration, through which the load balancer automatically checks the running state of backend ECSs. If a backend ECS becomes faulty, the load balancer will stop forwarding the traffic to this ECS. Add a Listener 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. In the Listeners area, click Add Listener. 6. In the displayed Add Listener area, specify the parameters as prompted. For detailed parameter descriptions of enhanced load balancers, see Table 2-4. For detailed parameter descriptions of classic load balancers, see Table

31 3 Management Delete a Listener 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. In the Listeners area, perform the following operation: Locate the row that contains the target listener, click More in the Operation column, and select Delete to delete an enhanced load balancer. Locate the row that contains the target listener, click Delete in the Operation column to delete a classic load balancer. NOTE If the listener has a backend ECS, remove the ECS first. 3.3 Whitelist You can add a whitelist to specify the IP addresses that can access the listener. NOTICE Only enhanced load balancers provide this function. Adding the whitelist may cause service risks. Once the whitelist is set, only the IP addresses specified in the whitelist can access the listener. If access control is enabled but no whitelist is added, the listener cannot be accessed. Add a Whitelist 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. In the Listeners area, locate the row that contains the target listener, click More in the Operation column, and select Configure Access Control from the drop-down list. In the displayed Configure Access Control dialog box, enable Access Control and enter the IP addresses as prompted. 27

32 3 Management Figure 3-3 Configuring access control Table 3-1 Parameter description Parameter Description Example Value Access Control If access control is enabled but no whitelist is not added, no IP address is allowed to access the listener. If access control is enabled and the whitelist is added, only IP addresses specified in the whitelist can access the listener. If access control is disabled, load listener can be accessed from any IP address. - 28

33 3 Management Parameter Description Example Value Whitelist Lists the IP addresses or network segments that can access the listener. NOTE A maximum of 300 IP addresses or network segments can be entered. A comma (,) is used to separate every two IP addresses or network segments , /24 6. Click OK. 3.4 Backend ECS Scenarios Add Backend ECSs This section provides operations for you to add backend ECSs to a load balancer or remove ECSs from a load balancer when you do not want to use them. Before adding a backend ECS, check whether the security group rule of the backend ECS is configured to permit /16 in the inbound direction, and configure the protocol and port used for health check. Otherwise, the health check cannot be performed on the added backend ECS. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. Backend ECS For classic load balancers, locate the row that contains the target listener and click Add Backend ECS in the Operation column. In the displayed Add Backend ECS dialog box, select the subnet and backend ECSs to be added. For enhanced load balancers, click the Backend ECS Group tab, locate the target ECS group, and click Add Backend ECS in the Operation column. 6. Click OK. Remove Backend ECSs 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 29

34 3 Management Add a Backend ECS Group 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. Select the backend ECSs to be removed. For classic load balancers, locate the target listener in the Listeners area and click the number in the Backend ECSs column. In the displayed Remove Backend ECS dialog box, select the ECSs. For enhanced load balancers, click Backend ECS Group and locate the target ECS group. Click the number in the Backend ECSs column. In the displayed Remove Backend ECS dialog box, select the ECSs. 6. To remove a single backend ECS, locate the row that contains the target ECS and click Remove in the Operation column. To remove multiple backend ECSs, select all ECSs to be removed and click Remove above the ECS list. 7. In the dialog box displayed, click OK. You can add a backend ECS group only for an enhanced load balancer. Perform the following operation to add the backend ECS group: 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the row that contains the target load balancer and click its name. 5. Under the Backend ECS Group tab, click Add Backend ECS Group. In the displayed dialog box, specify the parameters. Table 3-2 Backend ECS group parameters Item Parameter Description Example Value Backend ECS group Name Specifies the name of the backend ECS group. pool-6wk8 Backend Protocol HTTP TCP HTTP 30

35 3 Management Item Parameter Description Example Value Load Balancing Algorithm Sticky Session Specifies the algorithm that the load balancer uses for distributing the traffic. Weighted round robin: Connection requests are forwarded to backend ECSs in sequence based on the weight you have assigned so that all requests are evenly distributed to the ECSs. Weighted least connections: New connection requests are forwarded to the ECS processing the least connection requests, and the number of requests handled by this ECS depends on the assigned weight value. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. NOTE Choose an appropriate algorithm to distribute the traffic and improve load balancing capabilities. After the sticky session feature is enabled, the load balancer route requests in one session to the same backend ECS for processing. NOTE The sticky session feature is supported only when Load Balancing Mode is set to Round robin. Weighted round robin - 31

36 3 Management Item Parameter Description Example Value Sticky Session Type Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. HTTP cookie: The load balancer generates a cookie after it receives a request from a client. All the subsequent requests with the cookie are distributed to the same backend ECS for processing. App cookie: This type of sticky session relies on backend applications. All requests with the cookie generated by backend applications are distributed to the same backend ECS for processing. NOTE Only Source IP address is available when TCP is used as the frontend protocol. If HTTP or HTTPS is used as the frontend protocol, the sticky session type can be HTTP cookie or App cookie. Choose an appropriate sticky session type to distribute the access traffic and improve load balancing capabilities. Source IP address Cookie Name Specifies the cookie name. When App cookie is selected, you need to enter a cookie name. cookie1223 Description Provides supplementary information about the backend ECS group. Health check Health Check Mode Specifies the protocol used for health check. The value can be TCP or HTTP and cannot be modified once it is set. HTTP Interval (s) Specifies the maximum amount of time between health checks. 5 32

37 3 Management Item Parameter Description Example Value Timeout (s) Check Path Maximum Retries Specifies the amount of time you need to wait when receiving a response from the health check. Specifies the health check path, which is a URL. This parameter is required if Health Check Mode is set to HTTP. Specifies the maximum number of retries for the health check. The value ranges from 1 to /index.html Certificate Scenarios Create a Certificate A certificate is required when the listener uses the HTTPS protocol. You can upload a certificate and bind it to the listener to provide the HTTPS service. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the displayed page, click the Certificates tab. 5. Click Create Certificate and configure the following parameters in the displayed dialog box. Load Balancer Type: Select Enhanced or Classic. Certificate Name Description Certificate Content: The content must be in PEM format. Private Key Private Key: This must be an unencrypted private key. The format is as follows: 33

38 3 Management Delete a Certificate 6. Click OK. Modify a Certificate Bind a Certificate NOTE Private Key Private Key: This must be an unencrypted private key. The format is as follows: -----BEGIN PRIVATE KEY----- [key] -----END PRIVATE KEY----- If a certificate chain is used, you need to configure all the content and private keys from the sub-certificate to the root certificate and ensure that the content is configured in the same sequence as the private keys. For example, if you have three certificates in a sequence of sub-certificate > intermediate certificate > root certificate, the configuration sequence is the same. Only certificates that are not in use can be deleted. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the displayed page, click the Certificates tab. 5. Locate the row that contains the target certificate and click Delete in the Operation column. 6. In the displayed dialog box, click OK. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the displayed page, click the Certificates tab. 5. Locate the row that contains the target certificate and click Modify in the Operation column. 6. In the displayed Modify Certificate dialog box, modify the certificate information. 7. Click OK. 1. Log in to the management console. 2. In the upper left corner of the page, click and select the desired region and project. 3. Under Network, click Elastic Load Balance. 4. On the Elastic Load Balance page, locate the target load balancer and click its name. 5. In the Listeners area, click Add Listener. 6. In the displayed Add Listener dialog box, specify the parameters as prompted. When Protocol is set to HTTPS, a certificate must be deployed for the load balancer. 34

39 3 Management Table 3-3 Listener parameters Parameter Description Example Value Name Specifies the listener name. listener01 Load Balancing Protocol/Port ECS Protocol/Port Load Balancing Algorithm Default Certificate Specifies the protocol and port used for load balancing. A public network load balancer supports the following protocols: HTTP: load balancing at Layer 7 TCP: load balancing at Layer 4 HTTPS: encrypted load balancing at Layer 7 UDP: load balancing at Layer 4 A private network load balancer supports the following protocols: HTTP: load balancing at Layer 7 TCP: load balancing at Layer 4 HTTPS: encrypted load balancing at Layer 7 Specifies the protocol and port used by backend ECSs. Specifies the algorithm that the load balancer uses for distributing the traffic. Round robin: Each connection request is forwarded to the next ECS in sequence so that all requests are distributed evenly to all ECSs. Least connections: New connection requests are forwarded to the ECS processing the least connections. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. Choose an appropriate algorithm to distribute the traffic and improve load balancing capabilities. Specifies the certificate used by an HTTPS load balancer. You can select an existing certificate or create one. For details about how to create a certificate, see section 3.5 Certificate. This parameter is available only when Load Balancing Protocol is set to HTTPS. TCP/80 HTTP/80 HTTPS/443 TCP/22 Round robin cert-miij/ e1b1 a4526b346cd fb9b9f856a 35

40 3 Management Parameter Description Example Value Enable SNI SNI Certificate SSL Protocol SSL Cipher Sticky Session Specifies whether to enable the Server Name Indication (SNI) function when Load Balancing Protocol is set to HTTPS. SNI is an extension to Transport Layer Security (TLS) when a server uses multiple domain names and certificates. This function allows the client to submit the domain name information when sending an SSL handshake request. After receiving the request, ELB queries the right certificate based on the domain name and returns the certificate to the client. If no certificate is found, ELB returns a default one. Specifies the certificate associated with the domain name when Load Balancing Protocol is set to HTTPS. You can select an existing certificate or click Create Certificate to create one. Specifies the SSL protocol used by an HTTPS load balancer. This parameter is used to enable a specified encryption protocol: TLSv1.2 TLSv1.2 TLSv1.1 TLSv1 This parameter is available only when Load Balancing Protocol is set to HTTPS. Specifies the SSL password used by an HTTPS load balancer. The following options are available: Default Cipher Extended Cipher Strict Cipher This parameter is available only when Load Balancing Protocol is set to HTTPS. Only Extended Cipher is available when SSL Protocol is set to TLSv1.2 TLSv1.1 TLSv1. Specifies whether to enable the sticky session feature. After the sticky session feature is enabled, the load balancer route requests in one session to the same backend ECS for processing. NOTE The sticky session feature is supported only when Load Balancing Mode is set to Round robin. N/A N/A N/A N/A N/A 36

41 3 Management Parameter Description Example Value Stickiness Duration (min) Check Mode Interval (s) Timeout (s) Healthy Threshold Unhealthy Threshold Check Path Specifies the period of time that sticky sessions will be maintained. This parameter is available only when the sticky session feature is enabled. The parameter value ranges from 1 to Specifies the protocol and port used for performing health checks on ECSs. NOTE When UDP is used for health check, the security group rules of backend ECSs must allow access using the ICMP protocol. Specifies the maximum amount of time between health checks. Specifies the amount of time you need to wait when receiving a response from the health check. Specifies the threshold at which the health check result is considered normal. It indicates the number of consecutive successful health checks necessary for a backend ECS to be considered healthy. Specifies the threshold at which the health check result is considered abnormal. It indicates the number of consecutive successful health checks necessary for a backend ECS to be considered unhealthy. Specifies the health check URL. This parameter is available only when Check Mode is set to HTTP. NOTE Special characters -/.%?#&= can be contained in the path. 5 HTTP/ /test.html Table 3-4 Load balancer parameters Item Parameter Description Example Value Listener Name Specifies the listener name. listener01 37

42 3 Management Item Parameter Description Example Value Protocol/ Frontend Port Specifies the protocol and port used for load balancing. The port value ranges from 1 to 65535, and the following protocols are available: HTTP: load balancing at Layer 7 TCP: load balancing at Layer 4 HTTPS: HTTPS-based load balancing HTTP/80 Backend Protocol Specifies the protocol and port used by backend ECSs. N/A Certificates Specifies the certificate to be used when the frontend protocol is HTTPS. - Description Provides supplementary information about the listener. N/A Backend ECS group Backend ECS Group Specifies a group of backend ECSs that have the same features. Create now Not required Create now 38

43 3 Management Item Parameter Description Example Value Load Balancing Algorithm Specifies the algorithm that the load balancer uses for distributing the traffic. Weighted round robin: Connection requests are forwarded to backend ECSs in sequence based on the weight you have assigned so that all requests are evenly distributed to the ECSs. Weighted least connections: New connection requests are forwarded to the ECS processing the least connection requests, and the number of requests handled by this ECS depends on the assigned weight value. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. NOTE Choose an appropriate algorithm to distribute the traffic and improve load balancing capabilities. Weighted round robin 39

44 3 Management Item Parameter Description Example Value Sticky Session Type Cookie Name Description After the sticky session feature is enabled, the load balancer route requests in one session to the same backend ECS for processing. Specifies the sticky session type. The following options are available: Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. HTTP cookie: The load balancer generates a cookie after it receives a request from a client. All the subsequent requests with the cookie are distributed to the same backend ECS for processing. App cookie: This type of sticky session relies on backend applications. All requests with the cookie generated by backend applications are distributed to the same backend ECS for processing. NOTE Only Source IP address is available when TCP is used as the frontend protocol. If HTTP or HTTPS is used as the frontend protocol, the sticky session type can be HTTP cookie or App cookie. Choose an appropriate sticky session type to distribute the access traffic and improve load balancing capabilities. Specifies the cookie name. When App cookie is selected, you need to enter a cookie name. Provides supplementary information about the backend ECS group. Source IP address cookie

45 3 Management Item Parameter Description Example Value Health check Health Check Mode Specifies the protocol used for health check. The value can be TCP or HTTP and cannot be modified once it is set. HTTP Specifies the port used for health check. The value ranges from 1 to NOTE If no health check port is specified, the port of each backend ECS is used. 80 Interval (s) Specifies the maximum amount of time between health checks. 5 Timeout (s) Specifies the amount of time you need to wait when receiving a response from the health check. 10 Check Path Specifies the health check path, which is a URL. This parameter is required if Health Check Mode is set to HTTP. /index.html Maximum Retries Specifies the maximum number of retries for the health check. The value ranges from 1 to HTTP Method Specifies the HTTP request method. This parameter is required if Health Check Mode is set to HTTP. GET HTTP Status Code Specifies the returned status code for an HTTP. This parameter is required if Health Check Mode is set to HTTP or HTTPS Click OK. 41

46 4 Monitoring 4 Monitoring 4.1 ELB Metrics After you enable the ELB service, you can view the status of the load balancer on the Cloud Eye console without installing any plug-in. Table 4-1 lists the monitoring metrics of the classic and enhanced load balancers and Table 4-2 lists monitoring metrics of the enhanced load balancing listener. Table 4-1 Monitoring metrics of the classic and enhanced load balancers Metric Concurrent Connections Active Connections Inactive Connections New Connections Incoming Packets Outgoing Packets Inbound Rate Outbound Rate Abnormal Hosts Description Specifies the total number of concurrent connections processed by the monitored object. Specifies the total number of active connections processed by the monitored object. Specifies the total number of inactive connections processed by the monitored object. Specifies the total number of new connections processed by the monitored object. Specifies the number of incoming packets on the monitored object per second. Specifies the number of outgoing packets on the monitored object per second. Specifies the number of incoming bytes on the monitored object per second. Specifies the number of outgoing bytes on the monitored object per second. Specifies the number of abnormal backend ECSs. 42

47 4 Monitoring Metric Normal Hosts Description Specifies the number of normal backend ECSs. Table 4-2 Monitoring metrics of enhanced load balancing listeners Metric Concurrent Connections Active Connections Inactive Connections New Connections Incoming Packets Outgoing Packets Inbound Rate Outbound Rate Description Specifies the total number of concurrent connections processed by the monitored object. Specifies the total number of active connections processed by the monitored object. Specifies the total number of inactive connections processed by the monitored object. Specifies the total number of new connections processed by the monitored object. Specifies the number of incoming packets on the monitored object per second. Specifies the number of outgoing packets on the monitored object per second. Specifies the number of incoming bytes on the monitored object per second. Specifies the number of outgoing bytes per second on the monitored object. 4.2 Setting Alarm Rules 1. Log in to the management console. 2. Under Management & Deployment, click Cloud Eye. 3. In the left navigation pane, choose Alarm > Alarm Rule. 4. On the Alarm Rule page, click Add Alarm Rule to add an alarm rule, or modify an existing alarm rule. The following operations use the modification of an existing alarm rule as an example. a. Click the name of the target alarm rule. b. In the upper right corner of the displayed tab page, click Modify. c. On the Modify Alarm Rule page, set parameters as prompted. 43

48 4 Monitoring Figure 4-1 Modifying an alarm rule d. Click OK. NOTE After the alarm rule is modified, the system automatically sends you a notification when an alarm that complies with the alarm rule is generated. For more information about ELB alarm rules, see Cloud Eye. 4.3 Viewing ELB Metrics Scenarios Cloud Eye can be used monitor the running state of your load balancers. You can view the metrics of each load balancer on the management console. Monitored data requires a period of time for transmission and display. The status of each load balancer displayed on the Cloud Eye dashboard is not the latest. For a load balancer that is just created, you need to wait for about 5 minutes to 10 minutes to view its monitoring data. Prerequisites The load balancer has been running properly for a period of time. Cloud Eye does not display the metrics of stopped, faulty, or deleted load balancers. NOTE Cloud Eye stops monitoring load balancers that remain in stopped or faulty state for over 24 hours and removes them from the monitoring list. However, the alarm rules for such load balancers are not automatically deleted. You have configured alarm rules for your load balancers. Without alarm rules configured in Cloud Eye, the monitoring data is unavailable. For details, see section 4.2 Setting Alarm Rules. 44

49 4 Monitoring Procedure 1. Log in to the management console. 2. Under Management & Deployment, click Cloud Eye. 3. In the navigation pane on the left, choose Cloud Service Monitoring > Elastic Load Balance in the Operation column. 4. Locate the target load balancer and click View Monitoring Graph. 45

50 5 Audit 5 Audit With Cloud Trace Service (CTS), you can record operations associated with ELB for later query, audit, and backtrack operations. 5.1 Operations Recorded by CTS Table 5-1 lists the operations that can be recorded by CTS. Table 5-1 ELB operations that can be recorded by CTS Action Resource Type Trace Configuring access logs accesslog create access log Deleting access logs accesslog delete access log Creating a certificate certificate create certificate Updating a certificate certificate update certificate Deleting a certificate certificate delete certificate Creating a health check healthmonitor create healthmonitor Updating a health check healthmonitor update healthmonitor Deleting a health check healthmonitor delete healthmonitor Adding a forwarding policy Updating a forwarding policy Deleting a forwarding policy l7policy l7policy l7policy create forwarding policy update forwarding policy delete forwarding policy Adding a forwarding rule l7rule create forwarding rule Updating a forwarding rule l7rule update forwarding rule 46

51 5 Audit Action Resource Type Trace Deleting a forwarding rule l7rule delete forwarding rule Adding a listener listener create listener Updating a listener listener update listener Deleting a listener listener delete listener Creating a load balancer loadbalancer create loadbalancer Updating a load balancer loadbalancer update loadbalancer Deleting a load balancer loadbalancer delete loadbalancer Adding a backend ECS member add backend ecs Updating a backend ECS member update backend ecs Removing a backend ECS member remove backend ecs Creating a backend ECS group Updating a backend ECS group Deleting a backend ECS group pool pool pool create backend member group update backend member group delete backend member group 5.2 Viewing Audit Logs Scenarios After CTS is enabled, CTS starts recording operations on cloud resources. The CTS management console stores the last seven days of operation records. This section describes how to query the last seven days of operation records on the CTS console. Procedure 1. Log in to the management console. 2. Click in the upper left corner of the management console and select a region and project. 3. Click Service List. Under Management & Deployment, choose Cloud Trace Service. 4. Choose Trace List in the navigation pane on the left. 5. Specify the filters used for querying traces. The following four filters are available: Trace Source, Resource Type, and Search By Select the filter from the drop-down list. 47

52 5 Audit When you select Trace name for Search By, you also need to select a specific trace name. When you select Resource ID for Search By, you also need to select or enter a specific resource ID. When you select Resource name for Search By, you also need to select or enter a specific resource name. Operator: Select a specific operator (a user other than tenant). Trace Rating: Available options include all trace status, normal, warning, and incident. You can only select one of them. Start time and end time: You can specify the time period to query traces. 6. Click on the left of a trace to expand its details. Figure 5-1 Expanding trace details 7. Click View Trace in the Operation column. On the displayed View Trace dialog box, view details of the trace. Figure 5-2 View Trace 48

53 6 Best Practices 6 Best Practices 6.1 Enhanced Load Balancer Scenarios For web services where users need to register and log in, such as and (two online shopping malls in China), HTTP load balancing is recommended. The client and load balancer can communicate through a direct connection or VPN. Prerequisites Web messages are forwarded over HTTP. Cookie session persistence is enabled (a cookie ensures that requests of a user are sent to the same ECS for processing, preventing login exception and timeout). Requests can be evenly distributed (requests of different users are forwarded to different ECSs to balance load). Service fault detection and isolation are available. Configuration Reference Select a protocol. Select HTTP. Select an algorithm. Weighted round robin Enable Sticky Session. Configure health check. Select either the TCP or HTTP health check mode. If you select the HTTP check mode, you must ensure that an ECS health check page is available and that 200 is returned when you visit the page. 49

54 6 Best Practices 6.2 Classic Load Balancer Scenarios Configuration Reference Requests from the same client are forwarded to the same ECS for processing. The load balancer forwards data using TCP. A large number of long connections exist. Backend ECSs can evenly process messages. Requests from the same client must be forwarded to the same ECS for processing. 1. Create a load balancer. Specify the following information as required: Name Public network for Type VPC Bandwidth 2. Add a listener. Specify the following information as required: Select TCP for Load Balancing Protocol. Select TCP for ECS Protocol. Select Round robin for Load Balancing Mode. Enable Sticky Session. Configure Stickiness Duration, which must be longer than the session timeout duration. For example, if the session timeout duration is 3000s, you can set Stickiness Duration to 3600s. Select TCP for Check Mode. 3. Add backend ECSs. Select the target ECSs. 4. Check the health status of the target ECSs. 50

55 7 FAQs 7 FAQs 7.1 Can I Adjust the Bandwidth of a Load Balancer? You can adjust the bandwidth of a public network load balancer by adjusting that of the bound EIP. For details about how to modify the EIP bandwidth, see the Virtual Private Cloud User Guide. 7.2 What Load Balancing Algorithms Does ELB Support? Classic load balancers support the following algorithms: Round robin: sends requests to backend ECSs in polling mode. This forwarding rule applies to short-connection services, such as the HTTP service. Least connections: preferentially sends requests to the backend ECS with the least connections. This forwarding rule applies to long-connection services, such as the database service. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. Requests from the same client will be dispatched to a specific backend ECS. This rule applies to TCP connections of load balancers that do not use cookies. The enhanced load balancers support the following algorithms: Weighted round robin: Connection requests are forwarded to backend ECSs in sequence based on the weight you have assigned so that all requests are evenly distributed to the ECSs. This algorithm is often used for short connections, such as HTTP services. Weighted least connections: New connection requests are forwarded to the ECS processing the least connection requests, and the number of requests handled by this ECS depends on the assigned weight value. This algorithm is often used for long connections, such as database connection services. Source IP hash: The source IP address of the request is used as the hash key to identify the ECS in the static fragment table. Requests from the same client will be dispatched to a specific backend ECS. This rule applies to TCP connections of load balancers that do not use cookies. 51

56 7 FAQs 7.3 Does ELB Support ECSs Running Different OSs? Yes. ELB has no requirements for the OSs used on backend ECSs, only if your ECSs have consistent data and the same applications deployed. Although there are no specific requirements for backend OSs, it is recommended that you install the same OS on all of your ECSs to simplify operation and maintenance (O&M). 7.4 How Many Load Balancers Can I Have? By default, a single user can create 10 enhanced load balancers and five classic load balancers. If you need more load balancers, you can apply for a higher quota. The maximum number of load balancers is How Can ELB Support Multiple Certificates? Each listener supports only one certificate or certificate chain. If you have multiple certificates or certificate chains, you need to create more listeners. 7.6 How Can I Configure a Public or Private Network Load Balancer? When you create an enhanced load balancer, a virtual IP address (VIP) will be assigned and a private network load balancer is created by default. If you bind a public network IP address to the VIP, the load balancer can serve as a public network load balancer. An enhanced load balancer supports public and private network access simultaneously. When creating a classic load balancer, you can choose the public or private network type. 7.7 What Functions Do Listeners Provide? Listeners specify the load balancing protocol and port, ECS protocol and port, and forwarding policy. 7.8 What Is the Relationship Between the Load Balancing Algorithms and Sticky Session Types? The sticky session feature ensures that requests from the same user are forwarded to the same backend ECS. Three types of sticky sessions are available. Table 7-1 and Table 7-2 list the relationships between load balancing algorithms and sticky session types. 52

57 7 FAQs Table 7-1 Session stickiness of enhanced load balancers Load Balancing Algorithm Weighted round robin Sticky Session Type Layer 4 (TCP) Layer 7 (HTTP/ HTTPS) Source IP address Supported Not supported HTTP cookie N/A Supported App cookie N/A Supported Weighted least connections Source IP address Supported Not supported HTTP cookie N/A Supported App cookie N/A Supported Source IP address Source IP address Supported Supported HTTP cookie N/A Supported App cookie N/A Supported Table 7-2 Session stickiness of classic load balancers Load Balancing Algorithm Sticky Session Type Layer 4 (TCP/ UDP) Layer 7 (HTTP/ HTTPS) Round robin Source IP address Supported Not supported HTTP cookie N/A Supported App cookie N/A Not supported Least connections Source IP address Supported Not supported HTTP cookie N/A Supported App cookie N/A Not supported Source IP address Source IP address Supported Supported HTTP cookie N/A Supported App cookie N/A Not supported Round robin is recommended. Layer-4 sticky sessions use source IP addresses, and layer-7 sticky sessions use HTTP cookies. 7.9 What Are Protocols and Frontend Ports? Enhanced load balancers support load balancing using TCP (layer 4), as well as HTTP and HTTPS (layer 7) protocols. Classic load balancers support load balancing using TCP and UDP (Layer 4), as well as HTTP and HTTPS (Layer 7). You can select a protocol and port based on the service to provide. 53

58 7 FAQs Protocol TCP UDP HTTP HTTPS Function Application deployment using TCP Application deployment using UDP Web application Web applications using HTTPS 7.10 What Are ECS Protocols and Ports? Backend ECSs provide network service protocols and ports. For example, if Internet Information Services (IIS) is installed on a Windows ECS, the default protocol is HTTP, and the default port is Is the EIP Assigned to the ELB Service Exclusively Used? In the life cycle of your ELB service, this EIP is exclusively used by your ELB What Is the Impact of Deleting a Load Balancer? If your load balancer IP address has been correctly resolved to the domain name and the load balancer provides services properly, do not delete the load balancer. If the load balancer is deleted, its IP address and service configuration will be released, and the deleted data cannot be restored. If you recreate the load balancer, a new IP address will be assigned. You can also specify the original IP address when creating the load balancer How Do I Rectify a Health Check Failure? The ELB system initiates a heartbeat check on backend ECSs, and the load balancer communicates with backend ECSs over an intranet. To achieve a successful health check, you must ensure that your ECSs are routable from the intranet. You can perform the following steps to rectify a health check failure. 1. In the Listener area, locate the row that contains the listener for which the health check fails, and click View in the Health Check column. A dialog box is displayed. Health Check Mode: Ensure that the protocol has been configured and port has been enabled for the ECS to be checked. Check Path: If HTTP is used for the health check, check whether the health check path for the ECS is correct. 2. Ensure that software, such as the firewall, in the ECS, does not block the health check source IP addresses. 3. Check whether the rules of backend ECS security groups and network ACL allow access by /16, and configure the protocol and port used for health check. Obtain the health check protocol and port from the dialog box displayed in 1. 54

59 7 FAQs If the health check mode is not specified, the service port of the backend ECS will be used. If the specified health check port is different from that of the backend ECS, both the health check port and service port must be permitted. 4. If the health check failure persists, contact technical support How Can I Obtain the Real IP Address of a Visitor? Layer-7 (HTTP) load balancing automatically obtains real IP addresses of visitors using the X-Forwarded-For HTTP header. This function is enabled by default and cannot be disabled. Layer-4 (TCP) load balancing requires the TOA kernel module to obtain real IP addresses What Types of Sticky Sessions Does ELB Support? The enhanced load balancer supports the source IP address, HTTP_COOKIE, and APP_COOKIE sticky session types. The classic load balancer supports the source IP address and HTTP_COOKIE sticky session types. 55

60 8 Appendix 8 Appendix 8.1 Configure the TOA Plug-in Scenarios ELB provides customized service management strategies for customers. Before customizing the management strategies, ELB needs to obtain the IP address contained in the original access request. The TOA kernel module installed on backend ECSs can be used to obtain IP addresses (only IPv4 IP addresses) contained in the access requests. This section describes how to compile the TOA kernel module in the OS. The operations of configuring the TOA module for Linux OSs with kernel version of are different from those for Linux OSs with kernel version of 3.0 or later. NOTE It has been verified that the TOA module can work properly in any of the following OSs, but it does not support load balancers using the UDP protocol: CentOS 6.8 (kernel version ) SUSE 11 SP3 (kernel version ) CentOS 7/7.2 (kernel version ) Ubuntu (kernel version 4.4.0) OpenSUSE 42.2 (kernel version ) CoreOS (kernel version ) Prerequisites Procedure The development environment for compiling the kernel module must be the same as that of the current kernel. VMs can access the OS repositories. Users other than root must have sudo permissions. In the following operations, the Linux kernel version is 3.0 or later. 56

61 8 Appendix 1. Prepare the compilation environment. The following are operations for compiling the kernel module in different Linux OSs. Choose appropriate operations as needed. CentOS i. Run the following command to install the GCC: ii. iii. Ubuntu sudo yum install gcc Run the following command to install the make tool: sudo yum install make Run the following command to install the kernel module development package (the versions of the development package header and module library must be the same as that of the kernel): sudo yum install kernel-devel-`uname -r` i. Run the following command to install the GCC: ii. iii. SUSE sudo apt-get install gcc Run the following command to install the make tool: sudo apt-get install make Run the following command to install the kernel module development package (the versions of the development package header and module library must be the same as that of the kernel): sudo apt-get install linux-headers-`uname -r` i. Run the following command to install the GCC: ii. iii. CoreOS sudo zypper install gcc Run the following command to install the make tool: sudo zypper install make Run the following command to install the kernel module development package (the versions of the development package header and module library must be the same as that of the kernel): sudo zypper install kernel-default-devel For CoreOS, the kernel module is to be compiled in a container, which must be started before the kernel module is compiled. For detailed operations, see the CoreOS documentation. Obtain the documentation from the following link: 2. Compile the Kernel module. a. Use the git tool and run the following command to download the TOA kernel module source code: git clone 57

62 8 Appendix NOTE If the git tool is not installed, download the TOA kernel module source code from the following link: b. Run the following commands to enter the source code directory and compile the module: cd src make If no warning or error information is prompted, the compilation is successful. Verify that the toa.ko file has generated in the current directory. 3. Load the Kernel module. a. Run the following command to load the kernel module: sudo insmod toa.ko b. Run the following command to check the module loading and to view the kernel output information: dmesg grep TOA If TOA: toa loaded is displayed in the command output, the kernel module has loaded. NOTE After compiling the CoreOS kernel module in the container, copy the kernel module to the host system and then load it in the host system. Because the container for compiling the kernel module shares the /lib/modules directory with the host system, you can copy the kernel module in the container to this directory so that the host system can use it. 4. Set the script for automatically loading the kernel module. To make the TOA kernel module take effect upon system start, you can add the command for loading the TOA kernel module to your startup script. You can use either of the following methods to automatically load the kernel module: Add the command for loading the TOA kernel module to the customized startup script as required. Perform the following operations to configure the startup script: i. Create the toa.modules file in the /etc/sysconfig/modules/ directory. This file contains the TOA kernel module loading script. ii. The following is an example of the content in the toa.modules file. #!/bin/sh /sbin/modinfo -F filename /root/toa/toa.ko > /dev/null 2>&1 if [ $? -eq 0 ]; then /sbin/insmod /root/toa/toa.ko fi /root/toa/toa.ko is the path of the TOA kernel module file. You need to replace it with their actual path. Run the following command to add execution permissions for the toa.modules startup script: sudo chmod +x /etc/sysconfig/modules/toa.modules 58

63 8 Appendix NOTE After the kernel is upgraded, the current TOA kernel module does not match. Therefore, you need to compile the TOA kernel module again. 5. Install the Kernel module on multiple nodes. To load the kernel module in the same OSs, copy the toa.ko file to VMs where the kernel module is to be loaded and then perform the operations in 3. After the kernel module is successfully loaded, applications can obtain real IP address contained in the request. NOTE The OS version of the node must be the same as that of the kernel. In the following operations, the Linux kernel version is NOTE The TOA plug-in supports the OSs (CentOS 6.8 image) with a kernel of xx. Perform the following steps to configure the TOA kernel module: 1. Obtain the kernel source code package Linux el6.x86_64.rs.src.tar.gz containing the TOA module from the following link: Linux el6.x86_64.rs.src.tar.gz 2. Decompress the kernel source code package. 3. Modify compilation parameters. a. Open the linux el6.x86_64.rs folder. b. Edit the net/toa/toa.h file. Change the value of #define TCPOPT_TOA200 to #define TCPOPT_TOA254. c. On the shell page, run the following commands: sed -i 's/config_ipv6=m/config_ipv6=y/g'.config echo -e '\n# toa\nconfig_toa=m' >>.config After the configuration, the IPv6 module is compiled into the kernel. TOA is compiled into a separate kernel module and can be independently started and stopped. d. Edit Makefile. You can add description after the equal sign in EXTRAVERSION =. The description will be displayed in uname -r, for example, -toa. 4. Run the following command to compile the software package: make -j n NOTE n indicates the number of vcpus. For example, if there are four vcpus, n can be set to Run the following command to install the kernel module: make modules_install The following information is displayed. 59

64 8 Appendix Figure 8-1 Installing the kernel module 6. Run the following command to install the kernel: make install The following information is displayed. Figure 8-2 Installing the kernel 7. Open the /boot/grub/grub.conf file and configure the kernel startup upon system start. a. Change the default startup kernel from the first kernel to the zeroth kernel. To do so, change default=1 to default=0. b. Add the nohz=off parameter to the end of the line containing the vmlinuz toa kernel. If nohz is not disabled, the CPU0 usage may be high, causing uneven stress. Figure 8-3 Configuration File c. Save the modification and exit. Restart the OS. During the restart, the system will load the vmlinuz toa kernel. 8. After the restart, run the following command to load the TOA module: modprobe toa 60