Troubleshoot connection failures to a Linux instance

Click Diagnostics to open the self-service troubleshooting page and select the target region.

Step 1: Test remote connection with Workbench

Use Workbench, a tool provided by Alibaba Cloud, to test the remote connection. If an issue occurs during the remote connection, Workbench returns a specific error message and a solution. Follow these steps to perform the test:

1. Go to ECS console - Instances.

2. In the upper-left corner of the page, select a region and resource group.

3. Click the ID of the target instance to open its details page, and then click Remote connection.

4. In the Remote connection dialog box, find Workbench and click Sign in now.

5. Test if you can remotely log on to the instance.

   Workbench automatically fills in the basic information required to log on to the target instance. Confirm that the information is correct, enter your username and authentication credentials, and then attempt to log on. For instructions on remotely logging on to a Linux instance by using Workbench, see Connect to a Linux instance by using Workbench.

   • If the logon still fails, Workbench returns an error message and a solution. Follow the prompts to resolve the issue, and then try to connect again by using Workbench. For common Workbench issues, see Issues with VNC connections to an instance.

   • If you can log on using Workbench, the SSH service on the target instance is running properly. This rules out an SSH server-side issue. Continue to Step 2: Check the network.

Step 2: Check the network

If you cannot remotely connect to the Linux instance, first check if the network is working correctly.

1. Test the connection from a computer in a different network environment, such as a different network segment or from a different ISP, to determine whether the issue is with your local network or on the server side.

   • If the issue is with your local network or ISP, contact your local IT staff or ISP for a solution.

   • If the network adapter driver is faulty, reinstall it.

2. On your local client, use the ping command to test network connectivity to the instance.

   • If you detect a network anomaly, perform a packet capture for analysis. For more information, see Use a packet capture tool to capture network packets.

   • If ping requests time out or packets are lost, use a tool like tracert or mtr to perform link analysis and identify the source of the problem. For more information, see Use MTR for network link analysis.

   • If ping is not disabled in the system kernel but your ping test to the ECS instance fails, the internal firewall on the server may be dropping packets from your client.

     For more information, see Troubleshoot a failure to ping the public IP address of an ECS instance.

Step 3: Check port and security group

Check whether the security group configuration allows traffic on the remote connection port.

1. Go to ECS console - Instances.

2. In the upper-left corner of the page, select a region and resource group.

3. On the Instances page, click the ID of the target instance.

4. On the Security Groups tab, find the security group and click Manage Rules in the Actions column.

5. On the Security Group Details page, in the Access Rules section, on the Inbound tab, click Add Rule and add a rule with the following parameters.

   • Action: Allow

   • Priority: 1 (A smaller value indicates a higher priority. 1 is the highest priority.)

   • Protocol: Custom TCP

   • Source: Set this to your local IP address. You can visit https://cip.cc/ to get your IP address.

   • Destination: Select SSH(22).

6. Use the following command to test the port.

   telnet [$IP] [$Port]

   Note

   • [$IP] refers to the IP address of the Linux instance.

   • [$Port] refers to the SSH port number of the Linux instance.

   For example, if you run the telnet 192.168.0.1 22 command, a successful response is similar to the following.

   Trying 192.168.0.1 ...
   Connected to 192.168.0.1.
   Escape character is '^]'

   If the port test fails, see Troubleshoot port failures when an ECS instance can be pinged.

Step 4: Check CPU load, bandwidth, and memory

Remote connection failures can be caused by high CPU load, insufficient public bandwidth, or insufficient memory.

1. Check whether the CPU load is high.

   • The CPU load is high.

     A high CPU load is expected if your application has intensive disk access, network access, or high computing requirements. To resolve this resource bottleneck, upgrade the instance type. For more information, see Overview of instance configuration changes.

     Note

     For more information about how to resolve high CPU load, see Query and analyze CPU load on Linux systems.

     Note

     Check for virus infections: If CPU resources remain abnormally high after you rule out normal application activities, the instance may be infected with a mining virus. Mining malware maliciously consumes resources like the CPU, which causes the instance to lag, respond slowly, and in severe cases, become unreachable. For troubleshooting and protection, see Guide to handling and preventing mining viruses. If the instance is infected with ransomware, system files may be encrypted and locked, which can also prevent you from logging on. For more information, see Guide to enhancing instance protection against ransomware.

   • If the CPU load is not high, proceed to the next step.

2. Check for insufficient public bandwidth.

   A remote connection may fail due to insufficient public bandwidth. Follow these steps to check the bandwidth.

   1. Go to ECS console - Instances.

   2. In the upper-left corner of the page, select a region and resource group.

   3. In the instance list, click the ID of the corresponding instance. In the Configuration Information section, check the public bandwidth.

      If the public bandwidth is 0 Mbit/s, the instance has no public bandwidth allocation. To fix this, upgrade the bandwidth. For more information, see Modify the peak public bandwidth.

3. Check for insufficient memory.

   After you remotely connect to a Linux instance, the desktop may fail to display and the connection immediately closes without an error message. Insufficient memory can cause this issue. Follow these steps to check memory usage.

   1. Log on to the Linux instance by using VNC.

      For more information, see Log on to a Linux instance by using password authentication.

   2. Check the memory usage. If the memory is insufficient, we recommend that you upgrade the instance type to resolve the resource bottleneck. For more information, see Overview of instance configuration changes.