AWS Load Balancer Support
ALB 502, 503 and 504 errors: find which side is failing.
An ALB error can come from the load balancer itself or be passed through from your targets, and the response code alone does not say which. We separate the two with CloudWatch metrics and access logs, then fix the connection, timeout or capacity issue behind them.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Users see 502 Bad Gateway or 504 Gateway Timeout intermittently
- A 503 appears when all targets are unhealthy or being deployed
- Errors started after a deployment, scale-in or idle timeout change
- HTTPCode_ELB_5XX_Count rises while targets look fine
- Uploads or long requests fail after a fixed time
What you get
- Breakdown of errors by source: ELB, target or network
- Access log queries used for the diagnosis
- Timeout, health check and scaling changes
- CloudWatch alarms for 5xx and latency
How we do it
A clear, safe process you can follow along with.
1. Split ELB errors from target errors
In CloudWatch, HTTPCode_ELB_5XX_Count is generated by the load balancer, while HTTPCode_Target_5XX_Count is returned by your application. Only the first is a load balancer or connectivity issue. We also check UnHealthyHostCount and TargetResponseTime.
2. Enable and read access logs
ALB access logs record elb_status_code, target_status_code, target_processing_time and error_reason for each request. A 502 with target_status_code of - means the target closed or never answered cleanly, and the error_reason field helps classify it.
3. Diagnose 502
Frequent causes are a target that closes keep-alive connections before the ALB idle timeout (the application keep-alive timeout must be longer than the ALB idle timeout, by default 60 seconds), a crashed or restarting process, malformed HTTP responses or oversize headers, and for Lambda targets an invalid response format.
4. Diagnose 504
A 504 means the target did not respond within the idle timeout, or the connection to it could not be made. We look for slow queries, saturated workers, or security group and network ACL rules blocking ALB to target traffic, then raise the idle timeout only if long requests are legitimate.
5. Diagnose 503
A 503 usually means no registered healthy targets, for example during a failed deployment or when a health check path is wrong, or the target group has no targets for the matching rule. We check target health reason codes.
6. Fix at the source
Depending on the result, we raise keep-alive timeouts, add capacity or autoscaling, fix slow endpoints, correct the health check, tune deregistration delay for deployments, or move long jobs to asynchronous processing.
7. Verify and alert
We confirm the 5xx counts return to normal under load and set alarms on ELB 5xx, target 5xx, unhealthy hosts and target response time.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Only raising the idle timeout
It hides slow responses and can leave workers tied up.
App keep-alive shorter than ALB idle timeout
The target closes a connection the ALB is about to reuse, producing sporadic 502s.
Treating all 5xx as one problem
The ELB and target counters point to different owners.
Skipping access logs
Without them 502 causes are largely guesswork.
Frequently Asked Questions
What causes ALB 502 Bad Gateway?
The ALB got an invalid or no response from the target. Common reasons are the target closing a keep-alive connection early, the app crashing, or a malformed response.
What causes ALB 504 Gateway Timeout?
The target did not answer before the idle timeout, or the ALB could not connect to it. Slow requests and blocked security group rules are the usual causes.
How do I tell ALB errors from application errors?
Compare HTTPCode_ELB_5XX_Count with HTTPCode_Target_5XX_Count in CloudWatch, and check elb_status_code against target_status_code in the access logs.
Want Help With ALB 502, 503 and 504 errors: find which side is failing?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required