Inconsistent received bytes on AWS application load balancer

Question

I'm investigating why there was a peak in NetworkIn of my application load balancer.

So I enabled the access log of the load balancer, and sum the received_bytes of all the requests of 2020-08-03 11:44:00 UTC+0800.

received_bytes:

The size of the request, in bytes, received from the client (requester). For HTTP requests, this includes the headers. For WebSockets, this is the total number of bytes received from the client on the connection.

But the total bytes I get from the logs are just 458355 bytes, which is far less than 476.966MB in the picture above.

I use excel's function SUM(K:K) to calculate the total number of bytes in the logs.

The definition of NetworkIn can be found here.

The number of bytes received on all network interfaces by the instance. This metric identifies the volume of incoming network traffic to a single instance.

The number reported is the number of bytes received during the period. If you are using basic (five-minute) monitoring, you can divide this number by 300 to find Bytes/second. If you have detailed (one-minute) monitoring, divide it by 60.

Units: Bytes

Why are they inconsistent?

Answer 1

NetworkIn contains all the data transmitted to the EC2 instances behind the load balancer.

In my case, this includes all the data that the EC2s receive from a MySQL database.

The data transmitted from the database to the EC2s is not included in received_bytes, because it doesn't go through the load balancer.

That explains why the bytes of NetworkIn and the bytes of received_bytes are different.

The log of network interface can be enabled by clicking Services -> EC2 -> Network Interfaces -> pick a network interface -> Flow Logs tab -> Create flow log.