How do I identify which file was responsible for generating an HTTP 4XX error?

Question

I've been getting a lot of 4xx errors in CloudFront.
By analyzing your documentation, I have identified that this behavior may be related to Origin's caching configuration and/or the inclusion of cache control metadata.

In the cache statistics, represented in the attached images, I show the volume of errors received in the last 24 hours, in just one Origin, as an example of the error. The "server access logging" setting is disabled in the bucket configured as the distribution's Origin. Is there any way I can retrieve this information, considering that it is not possible for me to enable this feature?

My problem is: I have almost 1 TB of data in my Origin, how can I identify which file was responsible for generating this error, in response to the client's request?

![HTTP status codes - Daily](/media/postImages/original/IMvCnbm4vsSSy2RKAPMVG8cg)
![HTTP status codes - Hourly](/media/postImages/original/IMq7OIDtnzQMugeBAIX6Hepg)
![Server Access Logging](/media/postImages/original/IM9lWHRSQ5QU6nNF9QccyfHw)

Accepted Answer

Hi Fernando -

[You will need to enable access logs if you have not already.](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html) In those access logs, you should be able to find where those 4xx errors are coming from.  If you need some help querying the logs, [Athena is a good choice](https://docs.aws.amazon.com/athena/latest/ug/cloudfront-logs.html).

If you don't have the ability to turn on the logging, you may have to work with whoever owns IAM policies in your account or whoever owns the distribution.

How do I identify which file was responsible for generating an HTTP 4XX error?

Relevant content