Network Analysis

  • Last update: 2026-10-16
  • Overview

    Version

    FineOps Version
    Functional Change
    V2.39.0/

    Function Overview

    You can use Network Analysis to quickly locate network issues during project deployment, scaling, and troubleshooting, and download the evidence package for detailed analysis.

    This function is intended for the following users:

    1. Implementation and delivery engineers who need to confirm whether ports are open and links are reachable after deployment or scaling.

    2. O&M admins who need to perform daily inspections and periodically monitor changes in network connectivity.

    3. Technical support engineers who need to perform preliminary diagnosis of on-site issues and collect standardized troubleshooting evidence.

    Application Scenario

    1. The platform cannot be accessed after deployment, or the project fails to start.

    2. Access requests return 502 or 504 errors, and you need to check whether inter-node connectivity is unavailable or the container port is blocked.

    3. External dependencies are unreachable, such as cloud domains, the template market, the plugin market, and OAuth domains.

    4. You need to troubleshoot cross-layer issues, such as DNS resolution, port occupation, firewall and iptables rules, and container network exceptions.

    5. Evidence collection is required for complex issues, such as conflicts between physical server network segments and container network segments, and incorrect container network modes.

    Preparation

    Before executing network analysis, confirm that all conditions in the following table have been met. Otherwise, the results may be incomplete.

    PrerequisiteDescription
    OPS Agent is in the running status.

    The OPS Agent component has been installed on all project nodes and is in the running status. 

    Information collection depends on this component. Nodes with an offline component only generate SYS-01 check results, and subsequent IP address and port probing is not performed.

    Account permissions meet requirements.The current account has the viewing and operation permissions for the project in FineOps.

    Procedure

    Accessing the Network Analysis Page

    1. Log in to FineOps and click Project Management on the left.

    2. Select the target project to go to the project details page.

    3. Choose Health Inspection > Network Analysis to go to the Network Analysis page. The top of the page displays the collection and check scope, and Analysis Setting is displayed in the upper-right corner.

    The following table describes the collection and check scope.

    Category
    Content
    CollectionFirewall and iptables rules, container information, network system parameters, and host process information
    CheckReachability of inter-node dependency ports, host-mapped ports, and container ports; network system parameter change history; and application accessibility from the FineOps server


    Executing Network Analysis Manually

    This section describes how to execute a full check manually and obtain conclusions and an evidence package.

    1. Click the Network Analysis button. FineOps starts the check.

    2. Wait until the check ends. The check duration is related to the number of nodes and ports. A check for a single project usually takes 2 to 15 s.

    3. View the results in Check Result, including the number of severe items, warning items, passed items, and the check duration.

    4. Check abnormal items one by one in the result details table. The following table describes the columns in the details table.

    Column
    Description
    Check IDCheck item ID, such as NET-03 and SYS-02
    Check ItemName of the checked content
    Check ObjectSpecific node, URL, IP address, port, or parameter name
    StatusPassed, Alert, or Severe
    Check ResultChecked value or failure cause
    SuggestionAnomaly-handling suggestion

    iconNote:
    Check results are expanded by node, URL, port, kernel parameter, and repair event, so the same check ID may appear in multiple rows.

    5. To troubleshoot further, click Download Detailed Data Package in the lower-right corner of the result details table to export the diagnostic evidence package.

    The package contains the connectivity matrix, port listening and mapping information, DNS resolution results, system and container events in the last seven days, and summaries of iptables and firewalld.

    Configuring Automatic Analysis

    This section describes how to enable periodic checks, which are suitable for continuous observation of intermittent network issues.

    1. Click Analysis Setting in the upper-right corner of the page.

    2. Enable Automatic Analysis, which is disabled by default.

    3. Enter a value in Execution Interval and select Minute(s) or Hour(s) as the unit. The default value is 24 hours. The current setting is displayed at the bottom of the panel, for example, "Current Setting: Run once every 24 Hour(s)."

    4. Click Save for the setting to take effect.

    iconNote:
    For daily checks, keep Automatic Analysis disabled. Enable it only when troubleshooting intermittent or unstable network issues, and disable it promptly after the issue is located to avoid generating historical records that do not require attention.

    Viewing History for the Last Seven Days

    This section describes how to trace historical check results and compare network status changes.

    1. View historical check records in History for the Last 7 Days. The fields include the report type (manual or automatic), completion time, number of warning checks and passed checks, duration, and status.

    2. Click View Result to review details.

    3. Click Download Detailed Data Package to download the evidence package of the analysis.

    Result Validation and Troubleshooting

    Check Item Reference Table

    The following table describes the check content and common causes of abnormal results.

    ID
    Check ItemCheck Scope and CriteriaAbnormal StatusDescription and Common Cause
    SYS-01Agent Connection StatusIt matches project configuration nodes with running agent instances. A matched node passes. An unmatched node triggers a warning.AlertA node without a running agent instance lacks collection and probing channels. Restore the operation of OPS Agent and execute the analysis again.
    APP-01Web Application AccessibilityIt checks the project access address (accessUrl) and the configured Web node URL, and probes across TCP, TLS, and HTTP layers. The check result is Passed if the HTTP status code is 2xx or 3xx.AlertTCP-layer failure indicates that the network path or port is unreachable. TCP-layer success with TLS-layer failure indicates a certificate or protocol negotiation exception. An abnormal HTTP status code or response content indicates that the Web service is unavailable.
    NET-02Container Service Port ReachabilityIt first checks TCP connectivity from the source node to the target service port. If this TCP check fails, the agent on the target host accesses the container IP address and container port directly.AlertContinued unreachability from the host side indicates an issue with internal container service listening, the container network, or the container isolation layer, rather than inter-node connectivity.
    NET-03Host-Published Port ReachabilityIt maps internal container ports to host-published ports and tests access from the check source to the host-published ports. The check also records local public port results.AlertA reachable internal container port with an unreachable published port usually points to issues with Docker port mapping, NAT, iptables, or host listening configuration.
    NET-04Cross-Node Dependency Port ReachabilityIt identifies the actual source node, target node, and target port based on component topology and dependency rules. The source node then initiates a TCP connection to the target port.AlertThe check verifies whether cross-host routing, firewalls, security groups, and inter-node network policies allow dependency service communication.
    NET-05Required Domain Connectivity for Online UpgradesIt tests HTTPS 443 connectivity from the FineOps server to domain names required for online upgrades, such as cloud.fanruan.com, image repository domain names, and OSS domain names.AlertThis item requires no attention in a pure internal network environment. Online upgrades require 443 access from the FineOps server to the preceding domain names, as well as valid DNS, firewall, proxy, and TLS configurations.
    SYS-02Network Kernel ParametersIt compares the current values of predefined network-related sysctl parameters returned by the agent with the expected values.SevereA mismatch between the current value and the expected value may affect container communication or inter-node access. You need to adjust kernel parameter settings based on the suggestion.
    SYS-03Agent Network Parameter Auto-RepairIt reviews network parameter auto-repair events recorded by the agent and determines the repair status based on the write result, actual value after repair, and completion time.The check result is Severe if repair fails. The check result is Alert in case of an unknown result or a previous auto-repair event.A repair failure indicates that parameters were not restored to the expected values. An unknown result or a previous auto-repair event indicates configuration drift on the node or incomplete evidence.

    Status and Suggestion

    Status
    DescriptionSuggestion
    PassedThe checked item is normal.No action is required.
    AlertThe checked item is abnormal, or the evidence is incomplete.Troubleshoot based on the Suggestion column, and download the detailed data package if needed.
    SevereThe current parameter value does not match the expected value, or auto-repair fails.Handle check items with this status first. In most cases, you need to adjust values of host network kernel parameters.

    Typical Troubleshooting Path

    When check results contain multiple alerts, interpret them in the following order to narrow down the issues quickly.

    1. Check SYS-01 first to confirm whether all agent instances are running. If offline nodes exist, restore the agent first, and then run the analysis again.

    2. Check APP-01 to confirm whether the application entry can be accessed and determine whether the failure occurs at the TCP, TLS, or HTTP layer.

    3. When a port is unreachable, check NET-03, NET-02, and NET-04 in sequence. Check the host-published port first, then the internal container port, and finally the inter-node dependency port. Use the result to confirm whether the issue is in port mapping, inside the container, or in inter-node connectivity.

    4. When external dependencies, such as online upgrades, the template market, and the plugin market, are abnormal, check the domain connectivity conclusion of NET-05.

    5. If all check items pass but the issue persists, download the detailed data package. Collect system logs such as messages and journalctl if necessary.

    FAQ

    Does a warning mean the environment is faulty?

    No. A warning means that the result is abnormal or evidence is incomplete. For example, in an internal-only network, a warning for NET-05 is expected when domain names are unreachable. A successful auto-repair event is also shown as a warning for SYS-03. Check the Suggestion column and the actual deployment mode before taking action.

    Why does the number of check results change?

    Results are expanded by node, URL, port, kernel parameter, and repair event. The record count changes when the number of nodes, mapped ports, or repair events changes.

    Does the diagnostic data package keep occupying disk space?

    No. Exported packages are retained for seven days, with a maximum of 200 packages. Older packages are deleted automatically.

    Should Automatic Analysis stay enabled?

    No. Keep Automatic Analysis disabled by default. Enable it only for monitoring intermittent network issues, adjust the execution interval as needed, and disable it after the issue is located.

    What if all check items pass but users still cannot access the project?

    Download the detailed data package and confirm that all server-side layers are normal. Then check the client, office network, external load balancer, WAF, VPN, and cloud bandwidth. These issues require network administrator involvement because FineOps cannot collect client-side or external-network evidence.

    Attachment List


    Theme: Project Management
    • Helpful
    • Not helpful
    • Only read

    滑鼠選中內容,快速回饋問題

    滑鼠選中存在疑惑的內容,即可快速回饋問題,我們將會跟進處理。

    不再提示

    10s後關閉

    Get
    Help
    Online Support
    Professional technical support is provided to quickly help you solve problems.
    Online support is available from 9:00-12:00 and 13:30-17:30 on weekdays.
    Page Feedback
    You can provide suggestions and feedback for the current web page.
    Pre-Sales Consultation
    Business Consultation
    Business: international@fanruan.com
    Support: support@fanruan.com
    Page Feedback
    *Problem Type
    Cannot be empty
    Problem Description
    0/1000
    Cannot be empty

    Submitted successfully

    Network busy