How do I use ELB to troubleshoot why end users can't access my website?

Resolution

End users might experience the following issues:

• The page times out.
• The website is experiencing intermittent issues.
• There's a delay when the page is loading.
• They receive an HTTP 5XX status code error.

Do a DNS lookup and comparison

Check that your domain correctly resolves to the load balancer nodes' IP address so that the client's connection is sent to the correct IP address.

Run one of the following commands to get the domain's DNS records:

dig affected domain

-or-

nslookup affected domain

Then, run the following command to get the load balancer's DNS records:

dig lb-xxxxxxxxxx.us-east-1.elb.amazonaws.com

Compare the domain's DNS records with the load balancer's DNS records. When the list of IP addresses match, the check is successful. If the load balancer is in a scale-out state, then there might be more IP addresses than the DNS response can show. To get all the IP addresses, run multiple DNS queries.

Check the health status of the load balancer's backend instances or targets

An unhealthy backend Amazon Elastic Compute Cloud (Amazon EC2) instance or target might affect routing. If the targets are unhealthy, then the service might be down at the target or backend instance. Or, the load balancers can't get a response from the target or backend instance.

Review the health checks for your load balancer's type to determine the status of the backend instance or target:

• Application Load Balancer
• Network Load Balancer
• Classic Load Balancer

Note: When you turn off the cross-zone load balancing, you affect how requests are routed with Network Load Balancers and Classic Load Balancers. You can configure health checks on ports other than traffic ports. However, even when the target or backend instance is healthy, the target might not respond to inbound traffic.

Connect to the load balancer's nodes

Connect directly the load balancer's nodes to test the following:

• You can reach the load balancer's IP addresses that the DNS resolved.
• The issue happens only with a specific Availability Zone's subnet.

Note the load balancer's IP addresses. Then, try to connect to the IP addresses one at a time. It's a best practice to use the curl tool to perform this check. If you use a browser, then the test might not work because of certificate validations and the host header.

Run the following command:

curl -lvk protocol://ELB IP Address:port/path -H "Host: domain name"

Note: Replace protocol, ELB IP Address, port, path, and domain name with your values.

If you receive a response, then check whether the response is expected or an error. If the response is expected, then check the next IP address.

Check the load balancer for backend instance or target issues

Check the load balancer's communication status with the backend instance or target.

Confirm that the security groups, network access control list (network ACL), and routing allow access. Then, log in to the target or backend instance. Based on your operating system (OS), run one of the following commands to confirm that the web service is listening on the configured port:

Windows:

netstat -an | findstr "LISTEN" | findstr "port"

Linux:

netstat -an | grep LISTEN | grep "port"

Note: Replace port with the target or backend instance's listening port that's used when you register the target or backend instance to the load balancer.

If the listening port isn't listed, then the web service is down.

If the response shows that the port is listening, then run the following command:

curl -lvk protocol://localhost:port

Note: Replace protocol with the listening application service and port with the localhost port.

If you get a response from the preceding command, then your web service is functioning.

You can also initiate a connection from another instance in the same Amazon Virtual Private Cloud (Amazon VPC). Check whether the connection reaches and gets a response from the web service. The response shows what the load balancer receives when you try to connect to the target or backend instance.

Related information

Why can't I connect to a website that is hosted on my EC2 instance?