What scenarios increment metric HTTPCode_ELB_4XX of ec2 classic load balancer?

The HTTPCode_ELB_4XX metric for Classic Load Balancers is incremented when the load balancer itself generates 4XX error codes in response to client requests. Based on your observations, it seems there might be a discrepancy between what you're experiencing and how the metric should work.

According to AWS documentation, the HTTPCode_ELB_4XX metric should increment in the following scenarios:

1. When the load balancer receives a malformed request
2. When a client sends a request with the HTTP CONNECT method (which is not supported)
3. When the length of the method in an HTTP request exceeds 127 characters (resulting in HTTP 405)
4. When a client cancels a request or there's a network interruption (resulting in HTTP 408)

The metric is reported to CloudWatch and should be visible in the monitoring tab. When these errors occur, the load balancer sends the HTTP code to the client, saves the request to the access log, and increments the HTTPCode_ELB_4XX_Count metric.

For Application Load Balancers (which are different from Classic Load Balancers), these metrics are explicitly tracked as HTTPCode_ELB_4XX_Count.

If you're not seeing the metric increment despite receiving 4XX errors, you might want to:

1. Verify that you're looking at the correct metric in CloudWatch
2. Check if there's a delay in metric reporting
3. Ensure that the errors are actually being generated by the load balancer itself and not by your backend instances

For troubleshooting purposes, you can also check CloudWatch logs for more detailed information about the errors.
Sources
Troubleshoot a Classic Load Balancer: Response code metrics - Elastic Load Balancing
Troubleshoot a Classic Load Balancer: HTTP errors - Elastic Load Balancing
Troubleshoot your Application Load Balancers - Elastic Load Balancing
CloudWatch metrics for your Classic Load Balancer - Elastic Load Balancing