Skip to content

Real problems. Simulated examples.

Each example below is a question an engineer might ask, the checks the agent runs, and the answer it reaches. The resources and results are made up for illustration.

// 01 Simulated example

EC2 can't reach the internet

“Our app server in the private subnet can't reach the internet. Internal traffic is fine.”
  1. 01Instance is runningi-0a41 runningpass
  2. 02Security group allows outboundsg-07c2 egress 0.0.0.0/0pass
  3. 03Network ACL allows the return pathacl-1f9e ephemeral openpass
  4. 04Default route to the internetrtb-3b80 no 0.0.0.0/0fail

Root cause

The subnet's route table has no default route, so outbound traffic has nowhere to go.

Suggested fix

Add a 0.0.0.0/0 route to the NAT gateway.

// 02 Simulated example

The load balancer returns 504

“Checkout sometimes fails with 504 Gateway Timeout. Targets look healthy.”
  1. 01Connection errors to targetsTargetConnectionErrorCount 0pass
  2. 02TLS handshakes to targetsTargetTLSNegotiationErrorCount 0pass
  3. 03Targets have spare CPUapi CPU 41%pass
  4. 04Slow requests finish inside the idle timeoutp99 74s, idle timeout 60sfail

Root cause

The slowest requests take longer than the load balancer's 60 second idle timeout.

Suggested fix

Raise the idle timeout, or move the slow export to a background job.

// 03 Simulated example

Peered VPCs can't talk

“The billing service can't reach the database in the peered VPC.”
  1. 01Peering connection is activepcx-5d21 activepass
  2. 02Route from billing to database10.20.0.0/16 via pcx-5d21pass
  3. 03Route back from database to billing10.10.0.0/16 missingfail

Root cause

Only one side has a route, so replies from the database VPC have no way back.

Suggested fix

Add the billing VPC's range to the database VPC's route table, through the peering connection.

// 04 Simulated example

A private DNS name won't resolve

“Our internal database name returns NXDOMAIN from the new reporting server.”
  1. 01VPC DNS support and hostnamesenableDnsSupport truepass
  2. 02Private zone is associated with this VPCinternal.example not associatedfail

Root cause

The private hosted zone isn't associated with the reporting VPC, so its resolver can't see the record.

Suggested fix

Associate the private hosted zone with the reporting VPC.

// 05 Simulated example

S3 is denied from a private subnet

“Nightly backups to S3 fail with Access Denied from the private subnet.”
  1. 01S3 gateway endpoint existsvpce-8a02 availablepass
  2. 02Endpoint is on the subnet's route tablepl-6ea54007 presentpass
  3. 03Endpoint policy allows the bucketbackups bucket allowedpass
  4. 04Bucket policy allows this endpointaws:SourceVpce vpce-11b4 onlyfail

Root cause

The bucket policy only accepts an older endpoint, so requests through the new one are denied.

Suggested fix

Allow the new endpoint in the backup bucket's policy.

Watch the agent work through these on a network map.

Open the demo