Elastic Compute Service:Troubleshooting methods for connection issues to Linux instances

Use the self-service troubleshooting tool to identify issues

Begin by using the self-service troubleshooting tool to identify issues with your instance. Then, follow the provided guidance to resolve the issue. The steps for using the self-service troubleshooting tool are as follows:

1. Log on to the ECS console.

2. In the left-side navigation pane, click Troubleshooting.

3. In the top navigation bar, select the region and resource group to which the resource belongs.

4. Under the Instance Troubleshooting tab, select Instance Cannot Connect or Start Abnormally and follow the prompts to enter the details of the instance you want to check. The configuration items are described below:

   • Specific Issue: The description is as follows.

     Issue	Description
     Workbench Unable to Connect via Private Network	(Recommended) When using the Workbench tool, you cannot connect to the instance through its private IP address.
     Workbench Unable to Connect via Public Network	(Recommended) When using the Workbench tool, you cannot connect to the instance through its public IP address.
     SSH Connection Failure	(Recommended) You cannot connect to the instance using a third-party SSH tool.
     Remote Connection to Instance Unavailable	Troubleshoot the issue that prevents the instance from being connected remotely.

   • Configuration of the Instance to Be Checked: The description is as follows.

     When selecting Workbench Cannot Connect Over The Private Network, Workbench Cannot Connect Over The Public Network, or SSH Cannot Connect, you must complete the subsequent options.

     Configuration item	Description	Example
     VPC	Select the VPC where the instance is located.	vpc-bp1******
     Requester VPC	Set the IP address of the host from which you initiate the SSH connection. Note When you select Workbench Cannot Connect Over The Private Network or Workbench Cannot Connect Over The Public Network, the information is automatically populated and does not need to be modified. If you do not know the IP address of your local machine, you can visit https://cip.cc/ to obtain it.	47.***.***.***
     Destination Instance	Select the instance to be connected remotely, which is the instance to be checked.	i-******
     Target Port	The SSH remote connection port of the destination instance (default is 22).	22

5. Click Start Troubleshooting, wait for the system to diagnose the issue, and once the diagnosis is finished, follow the on-screen instructions to resolve the problem.

Step 1: Use Alibaba Cloud Workbench to test remote logon

Use Alibaba Cloud Workbench to connect to the instance. If an exception occurs during remote logon, Workbench will return a specific error message and solution. The test steps are as follows:

1. Log on to the ECS console.

2. In the left-side navigation pane, choose Instances & Images > Instances.

3. In the top navigation bar, select the region and resource group to which the resource belongs.

4. On the instance list page, locate the instance you want to connect to and click Actions in the Remote connection column.

5. In the pop-up Remote connection dialog box, click Workbench and then click Sign in now.

6. Verify whether you can connect to the instance.

   Workbench automatically populates the basic information required for logon to the target instance. Confirm that the information is correct, enter the username and authentication information, and proceed based on the following results. For more information on connecting to a Linux instance using Workbench, see Connecting to a Linux Instance Using Workbench.

   • If you still cannot log on, Workbench will return an error message and solution. Follow the system prompts to resolve the issue. After resolving, test the remote logon with Workbench again. For assistance, here are some common exceptions when using Workbench: Issues Connecting to Instances Using VNC

   • If you can log on normally using Workbench, it indicates that the SSH service on the target instance is functioning properly, ruling out the possibility of an SSH server-side issue. Continue to Step 2: Check the Network for further troubleshooting.

Step 2: Check the network

If you cannot connect to a Linux instance, check the network connectivity of the instance.

1. Attempt to connect to the instance from computers within different CIDR blocks or from different network providers to determine if the issue lies with the local network or the server side.

   • If the issue is related to your local network or your internet service provider, contact your IT department or service provider.

   • If the issue is with a network interface card (NIC) driver, reinstall the driver.

2. Run the ping command from your local client to test the network connectivity to the instance.

   • If a network exception occurs, capture packets for analysis. For more information, see How to Capture Packets for Network Exception Analysis.

   • If packet loss occurs or the instance is unreachable, use tools such as tracert or mtr to perform link tests and identify the root cause. For more information, see Using the MTR Tool to Analyze Network Links.

   • If intermittent packet loss occurs and the network connectivity of the ECS instance remains unstable, the instance may be infected with a virus. For more information, see Testing Intermittent Packet Loss of an ECS Instance's IP Address Using the Ping Command

   • If ping is not disabled in the kernel of the Linux instance and you cannot ping the instance from your local client, the firewall within the instance may be configured to block traffic from the client.

     For more information, see Solutions for Ping Failure in ECS Instances with Ping Enabled in the Linux Kernel.

Step 3: Check ports and security groups

Ensure that the necessary connection ports are open in the security groups associated with the instance.

1. Log on to the ECS console.

2. In the left-side navigation pane, choose Instances & Images > Instances.

3. In the top navigation bar, select the region and resource group to which the resource belongs.

4. On the Instance List page, click the corresponding instance ID.

5. Under the Security Groups tab, click Manage Rules in the Operation column of the security group.

6. On the Security Group Rule page, you can select from several methods to add an inbound security group rule. For more information, see adding security group rules.

   • Method 1: Quickly Add a Security Group Rule

     • Authorization Policy: Allow

     • Port Range: SSH (22)

     • Authorization Object: Set this to your local IP address. You can visit https://cip.cc/ to retrieve your local IP address.

   • Method 2: Manually Add a Security Group Rule

     • Authorization Policy: Allow

     • Priority: 1 (the highest priority for security rules, with smaller numbers indicating higher priority)

     • Protocol Type: Custom (TCP)

     • Port Range: SSH (22)

     • Authorization Object: Set this to your local IP address. You can visit https://cip.cc/ to retrieve your local IP address.

7. Execute the following command to verify that the port is functioning as expected.

   telnet [$IP] [$Port]

   Note

   • [$IP] represents the IP address of the Linux instance.

   • [$Port] represents the RDP port number of the Linux instance.

   The system should display a message similar to the following. For example, if you run the telnet 192.168.0.1 22 command, the expected result is similar to the following.

   Trying 192.168.0.1 ...
   Connected to 192.168.0.1.
   Escape character is '^]'

   If the port test fails, refer to Port Availability Detection when the Ping Command Works but the Port is Unavailable for troubleshooting.

Step 4: Check CPU load, bandwidth, and memory usage

If you are unable to connect to a Linux instance, it may be due to high CPU load, insufficient public bandwidth, or low memory.

1. Examine the CPU load on the instance and take action based on the results.

   • In case of high CPU load.

     When applications hosted on the instance frequently perform disk read/write operations, initiate numerous network requests, or generate compute-intensive workloads, a high CPU load is anticipated. Upgrading the instance type can alleviate resource bottlenecks. For more information, see an overview of upgrade and downgrade methods.

     Note

     For additional guidance on addressing high CPU load, see Query and Case Analysis of CPU Load in Linux.

   • If the CPU load is not high, proceed to the next step.

2. Address insufficient public bandwidth issues.

   If you are unable to connect to a Linux instance, it may be due to insufficient public bandwidth. To troubleshoot, follow these steps:

   1. Log on to the ECS console.

   2. In the left-side navigation pane, choose Instances & Images > Instances.

   3. In the top navigation bar, select the region and resource group to which the resource belongs.

   4. On the Instance List page, click the corresponding instance ID. Then, in the Configuration Information section, check the Public Bandwidth details.

      If the bandwidth is 0 Mbps, it indicates that no public bandwidth was allocated when the instance was created. You can upgrade the bandwidth to resolve the issue. For more information, see Modifying the Peak Public Bandwidth.

3. Investigate insufficient memory issues.

   If the desktop environment does not display correctly for the Linux instance or the instance exits unexpectedly after you connect, the instance may have low memory. Check the memory usage of the instance as follows:

   1. Log on to the Linux instance using VNC.

      For detailed instructions, see Logging on to a Linux Instance Using Password Authentication.

   2. Monitor the memory usage. If the instance has insufficient memory, consider upgrading the instance type to address the resource bottleneck. For more information, see Overview of Upgrade and Downgrade Methods.