Traffic spike alert appears at the origin in AEM as a Cloud Service
This article explains how administrators and developers can investigate and respond to traffic spike alerts at the origin in Adobe Experience Manager as a Cloud Service (AEMaaCS) environments.
Description description
Environment
- Adobe Experience Manager as a Cloud Service Sites production environment
- Actions Center origin traffic spike alert
Issue/Symptoms
- You receive an automated alert indicating a traffic spike at the origin.
- Request volume increases noticeably over a short period.
- Traffic is distributed across multiple site resources rather than concentrated on a single endpoint.
Cause
The alert is triggered when traffic from a client IP exceeds an Adobe-defined request rate at a CDN PoP. The alert identifies a threshold event; it doesn’t by itself confirm a DDoS attack or service disruption. Traffic sources include legitimate user activity, security scans, automated systems, integrations, and unwanted requests. Review traffic patterns, blocked requests, and service health to determine whether the event requires further action.
Resolution resolution
Follow the steps below to address the issue:
-
Review the traffic spike alert. Record its timestamp and the affected environment.
-
Analyze request volume and patterns:
- Compare request counts and peak rates with the environment’s normal traffic baseline.
- Determine whether the spike is distributed across multiple endpoints or concentrated on specific paths.
-
Identify the most frequently accessed URLs during the spike window. Compare the requests with normal browsing patterns and check for concentrated or repeated access.
-
Investigate traffic sources:
- Review geographic distribution and CDN point-of-presence (PoP) data when available.
- Review the top client IPs. When traffic passes through an upstream CDN, the logged address represents a forward proxy rather than the end user.
-
Determine which AEM service or environment received most of the requests, such as Publish, Preview, or Author, using the available logs.
-
Review available CDN logs and traffic-filter results for DDoS mitigation flags, WAF alerts, and blocked requests. Record whether significant traffic was blocked.
-
Document the findings. Determine whether the traffic matches expected activity or requires further investigation; don’t classify it as an attack based only on the alert.
-
For recurring or suspicious spikes:
- Review logs to identify the IP addresses contributing to the traffic.
- Check whether internal security scans or scheduled activities occurred during the spike.
- If the evidence identifies unwanted traffic, configure an appropriate traffic-filter or rate-limit rule. Start in logging mode, review which requests match, and use blocking only after confirming that legitimate traffic won’t be affected.
- Continue monitoring traffic patterns and update the configuration based on the results.
-
If you need further assistance, contact Adobe Support.
After completing these steps, confirm that the environment serves expected requests normally and that traffic-filter rules aren’t blocking legitimate requests.