Network Error Logging (NEL) Tools

Historically in web development, once a site was published, and users were happy accessing content, the only visibility we would see were access logs, recording each item being fetches from the servers we control.

Over time, web developers added JavaScript tracking codes, which as with Google Analytics, which would record data to a dedicated endpoints that would then produce analytics reports.

And that’s where things stopped for a long time.

The user experience, or any issues they get, were never seen. If a JavaScript exception happened out on the Internet with a user, the developers would almost never hear about it unless that person submitted a bug report or kicked up a fuss on social media — enough to get someone’s attention. Occasionally sites would have a security.txt document that would list a security contact, to avoid the issue of tracking down someone within an organisation how actually knows how the web site works and who is responsible.

However, over the last 10+ years the state of error reporting in the browser has matured, but very few sites have publicly implemented it at this time. This is NEL: Network Error Logging.

I say publicly, as the error reporting is also useful to implement in development and test environments, for developers to get their hands on reports.

Support for collecting and submitting NEL has been improving, as shown in https://caniuse.com/mdn-http_headers_nel. Still we don’t yet see Firefox or Safari implementing this yet as at 2026…

I have written and released (Creative Commons) a set of tools on GitHub that help you implement and test NEL.

What will NEL tell me?

  • DNS Phase (dns): Errors that occur during domain name resolution.
    • dns.unreachable: The user’s DNS server is unreachable.
    • dns.name_not_resolved: The DNS server responded but could not resolve an IP address.
    • dns.failed: DNS lookup failed for other reasons (e.g., SERVFAIL).
    • dns.address_changed: DNS address changed unexpectedly.
  • Connection Phase (connection): Errors during TCP/TLS or socket establishment.
    • Examples include TCP connection timeouts (tcp.timed_out), refused connections (tcp.refused), or TLS/certificate validation errors (tls.cert.authority_invalid).
  • Application Phase (application): Errors occurring during the transmission or reception of HTTP request and response data (including HTTP 4xx and 5xx status codes or protocol errors).
  • Unknown Phase (unknown): Unclassified or general network drop-offs.

The NEL Endpoint

One of the first things you need is an endpoint to receive your reports. You can have as many of these as you like, such as for production environments versus non-production.

The NEL endpoint I have templated is standard HTTPS service listening to the network for a submission, with a custom hostname and a matching, valid TLS certificate.

My implementation to stand up in an AWS account from the CloudFormation template put reports that are submitted into a DynamoDB table. The operational cost of this should only be a few cents per month: its a Serverless implmentation.

Simulating NEL Reports to the Endpoint

The second thing you may want is to send some test submissions into your NEL server, as in the real world, these come in when they are ready. You can point this script at your own endpoint, and confirm that reports are being accepted and populated into your table.

If you want to force YOUR OWN Chrome browser to send reports in more rapidly, then run the Chrome executable with the flag –short-reporting-delay, as shown https://developer.chrome.com/docs/capabilities/web-apis/reporting-api.

Checking your Server HTTP Headers for NEL

Actually, you’ll need at least two headers: the NEL header, and then either the older Report-To, or the newer Reporting-Endpoints header. So the third item I am releasing is something that connects to your web site, and inspects the configuration of these headers.

Tuning the number of reports

There’s two tuning variables you can set in the NEL header: success_fraction, and failure_fraction. Each of these are a float number between 0 and 1, and they default to zero. If you want to see a sample of the failures that your clients are seeing, then increase that to a non-zero value: in your non-production environments, you could use 1. In the real world production, you probably only want to get 1% of error reports, depending on the volume of traffic you receive from the web. You can tune accordingly.

Get these on GitHub

You’ll find the three items in GitHub: https://github.com/JamesBromberger/network-error-logging-tools

Why use these?

In production – wouldn’t you like to get reports from the real world users, instead of being in the dark about any problems your clients are experiencing? This reminds me of a quote from Ian Fleming’s James Bond: Golden Eye:

Bond: Are these pictures live?
M: Yes, unlike the Americans, we prefer not to get our bad news from CNN.

In Non-production: this can help diagnose issues you are seeing with your deployments, and (as above) perhaps to a dedicated NEL endpoint for non-production sites. Adjust the Reporting-Endpoints URLs accordingly.

Keep calm and keep patching

OMG, I’m seeing PHP in the mainstream media news.

Today I checked in on this platform, as PHP powers WordPress, which is this blog platform. I self host, on my own VM (EC2 Instance), sitting behind Amazon CloudFront.

CloudFront is natively providing some protection, as only specific URLs I expose have support for HTTP POST actions. Most URLs only accept HTTP GET.

But there’s another power move: I’m running Debian; and the Debian team had patched PHP versions out earlier today. But on top of that, I have automated package installation active.

You can too, with:

dpkg-reconfigure -plow unattended-upgrades

So when I checked in my system today, it was already patched.

Meanwhile, we see legacy organisations panicing, taking systems offline, or worse – doing nothing and remaining vulnerable.

It reminds me of the recent article where an individual in Australia used an AI tool to try and book a gym session, and the AI tool found the API was unprotected, and proceeded to cancel someone else’s booking to take their slot. The issue is not the AI tool; is the unprotected vulnerable API.

Do better, people. Patch, secure, authenticate, log, provide minimal exposure. Use AI tooling to help you. Get experts in. Experience counts.

AWS Cloud Migration Considerations

I am very pleased to share that my first book, AWS Cloud Migration Considerations, is now available to purchase in paperback (ISBN 13: 978-1-7649507-0-1).

Cover image of the 2026 book AWS Cloud Migration Considerations, by James Bromberger

This work started as a collection of blog posts in the early 2020s, but I kept refining, rewriting, expanding and changing it to the point that it became too much to be a series of blog posts. With a few pushes from friends in the industry, I started to think about self-publishing.

What came out of this are the perspectives that I have gained in AWS Cloud Migration space.

Why listen to me?

For those new here, why would you care about what I say? Lets condense it to a list:

  • I am the world’s longest AWS-certificate person, with an AWS Solutions Architect – Associate cert from January 2013, to today.
  • I spent almost three years as the (only) security solution architect at AWS for the Australia and New Zealand market
  • During my time at AWS, I served on the Global security & compliance board, helping select which compliance programs AWS would apply for in my part of the world, in particular in Australia
  • I was around the 10th AWS employee in Australia, and the first in Western Australia, opening the office in Perth in April 2012
  • I ran a global AWS Consulting practice within the Adecco Group for 12 years, peaking in the top 100 of all AWS partners worldwide (by count of recognised AWS certifications in my teams)
  • I have a background in Linux and Open Source , Networking, and implementing and operating internet facing systems at scale: ecommerce, advertising, financial services, lands industry, and higher education; systems of record and critical national infrastructure
  • I have held national governemnt seurity clearance(s)
  • I have used AWS since 2008, which is a fair amount of the time its been around for now
  • I have been inside (one of the halls of) US-East-1
  • I have used GovCloud (USA), and AWS China, as well as many of the AWS Commercial Partition Regions, and did a speaking tour of Germany around the European Sovereign Cloud region

So why buy my book?

Well, I am experimenting in this – perhaps it may be easier to share my thoughts in long-form in print, and have it count for something. Different people consume ideas and approaches via different medium, and a traditional physical print works for some.

They say everyone has a book in them, trying to get out. Well, this is my first one. There’s something permanent about print as well. A nice touch I can do a soppy dedication to my wife and children too.

What do I get from each book sale?

After tax, it’s about the price of a cup of coffee.

How many copies do I think I will sell?

Huh, I really don’t know. Stay tuned and we’ll see.

Will I do a Kindle/ePub version?

Perhaps, but not right now; I’d need a good reason to. I have the ISBNs (every variant/medium needs its own unique ISBN), but perhaps need the time, funding and motivation.

Do you have another book to write?

I keep thinking of doing a picture book of my small dog, Gracie (a 7 year old Moodle, a white fluffball with brown ears). She has a habit of finding socks and then redistributing them through the house, and occasionally outside. I think it would be called “Gracie The Sock Thief“, and be a set of photos when I have caught her “red handed”, or more “sock-in-mouth” on her dastardly deed.

Do I have more cloud advice to share?

Oh yes. But I don’t know if it’s going to be a book.

What about a book tour/book launch?

Many people have said you don’t write a book to make money”. Well, there’s no money (currently) for a tour, unless that tour is from my house to the middle of Perth ($2.80 on public transport, or $12 for a day of parking)! If you have suggestions or invites, LMK!

Can I come and talk at your AWS User Group?

Travel permitting, I would love to. I started the AWS User Group in Perth, have presetened there many times, as well as many other User Groups (see https://cv.jamesbromberger.com for a longer list).

Can you come and talk to my organisation about Cloud?

Sure, please check out my consulting brand https://nephology.net.au/. I can travel pretty much anywhere within reason (and per diem).

Have me check your AWS Cloud config

It’s 2026, and since 2012 (14 years) I am now back to independent consulting. Lets check what’s changed in the IT industry (locally, nationally, and globally), and how I have changed since I was last available for short term engagements:

Globally: Cloud & IT

AWS continues to dominate the global cloud hyper scalar field, which in 2012 was almost exclusive to AWS. Its grows in size with the number of services, and the number of regions.

In early 2012, there were just 7 AWS Regions active: US-East 1, US-West-1, Dublin, US-West-2 (Oregon), SA-East-1 (Sao Paulo), AP-Northeast-1 (Tokyo), (ap-southeast-1 (Singapore). Today in 2026 there are 39 – over 5 times as many.

Back then Local Zones, which are Availability Zones that are considerably distant from their controlling Region and often have limited cloud managed services available compared to standard AZs, did not exist: now there are more then 30, bringing low latency between additional population centers to EC2 compute and some additional services.

On the flip side, in 2012 it was unheard of to hear about two things: price rises, and service terminations.

It was often highlighted that the original key-value store service, SimpleDB, was still operational. It was eclipsed by Dynamodb in almost all measurable ways, but the point was that the original SimpleDB service was still operational; clients that had depended upon it in 2007 could continue to do s

However for other AWS services, this has seen them come and go. For most of these, this is acceptable, particularly if they had been ended before organisations came to be largely dependant on them, or if there was a seamless transition to a suitable replacement. Anything else is work for clients to do, which is cost to adopt a change.

Of course, we have also seen industry fads come and go: blockchain, IoT, digital twin, metaverse. The volume of messaging around these have been distracting from the value of many systems. Organisations paid huge sums for virtual digital reality in the metaverse – all of which is practically worthless because, as we discovered with 3d TV in the 1990s: no one wants to wear an expensive 3D headset all day.

Nationally: Cloud & IT

In Australia, the launch of the AWS Region in Sydney at the Customer Appreciation Day in 2012 was huge. I spent time working at AWS on the global compliance board, selecting the industry validations that would become critical: key amongst this at the time was IRAP for the Australian government.

The day AWS opened, with its at-the-time cost focus on data transit, dropped the previous days industry rate by almost half. Incumbent telco carriers had been charging vast amounts, and AWS cut that bill down just by existing.

Throughout this period many government services digitised, and the increased online spend, versus clicks and mortar shopping malls continued to rise. Today sees vastly increased courier delivery services, much reduced postal letter service (just send an email/text), and much lower footfall in most retail spaces.

Even in major city centres, the retail sectors are seeing reduced sales, and increased retail property vacancies. Those vacancies become a flywheel, as more organisations leave, less shoppers want to visit those locations, and so more retails exit the space.

Buoyed by the national broadband network, we’ve seen Australia remove most analogue last-mile connections; the kind that used to have a voice circuit, and perhaps a DSL channel. The data volumes and number of digital devices online in the home have also increased (link):

YearAverage Monthly Household DownloadsAverage Connected Devices per Home
2013~40 GB7 devices
2019~250 GB17 devices
2023~443 GB22 devices
2025/2026~508 GB25 devices

All of those devices are talking to some digital backend. Australian Bureau of Statistics (ABS) claims around 10.9 million households, which would but that at around 272.5 million devices all up. Each one of those devices is getting data from, or sending it to, somewhere – and that’s often the largest most cost effective cloud provider, even if it gets down-streamed to other locations later.

The ABS itself, in charge of the Australian Census, has moved to AWS for the last few, following the disaster using IBM SoftLayer in 2016, an event later dubbed #CensusFail with the capacity overload triggering insane reactions of hacking from other nation states when it was really that … the engineering was unacceptable. Several things have changed this then: one, they allowed people to complete the census over an extended window instead of everyone on the same 4 hour evening, and second: they moved to AWS.

Locally: Cloud & IT

When I opened the AWS office in Perth in April 2012, there were two people. Today there are hundreds.

The AWS Local Zone opened in Perth in January 2023, conjoined to the Sydney Region. AWS also opened local Direct Connect (fibre) interconnect service in Perth, helping dramatically cut the cost of private connectivity (by more than 10x).

My skills growth

When I first achieved the AWS Solutions Architect – Associate certification in January 2013, I was in the initial cohort at AWS to achieve this. Today I still hold this AWS Certification (and 8 others), revalidated over the years with re-certification. From what I am aware, I am the only person from that initial cohort to still have that certification, making me the longest certified person in the world.

I spent some time over the period expanding this, and serving as a Subject matter Expert helping write the AWS questions for their certifications.

For much of the last 10 years, I have spent a fair bit of time focusing on soft skills: collaboration, engagement, retention, planning training and upskill for thousands of engineers. My leadership style was always to lead-from-the-front, earning the trust and respect of the engineers, showing them that I can do the job, and direct it — unlike many others who direct without being able to do – career managers who don’t directly understand the depth, complexity, constraints and cognitive effort to shape and secure reliable digital systems.

One key aspect has been facilitating and pushing the sharing of knowledge. This works well to ensure continuity in the face of change. When organisations don’t value that approach, we often see system failure, compliance issues, interruption of service or other symptoms where digital systems that were once well-maintained, become rigid and dormant.

The Well-Architected Journey

In late 2014, while at AWS, I was asked to participate in defining some concepts to help AWS cloud customers navigate the problem of having too much choice in AWS.

There’s More Than One Way Do To It was a Perl developer saying, and this became true in AWS as well. There had to be some level of balance.

What we came up with was 5 pillars of Well-Architected. This framework was initially for AWS’s own Solution Architect teams to use, but became public in 2016 as a concept, complete with the concept of a Well-Architected Framework Review, a consulting service where independent services partners could bring their smart people in to a client, offer that advice, and provide the client with visibility as to what they could modify to get further benefit.

The balance of priorities was something I took to my AWS cloud engineering teams in global practice starting from my first day in 2014. It helped guide architecture for services that not only optimised cost, but exceeded the expectations for reliability and scalability, including during a complete Availability Zone outage in 2016. When other large organisations were being paraded on the nightly news for their outages, my clients were continuing unabated.

Available Now for you

So what can (or should) I do with nearly 16 years of cloud architecture experience, a spell as the security solution architect for AWS for all of Australia & New Zealand, longest-certified person in the world, certification SME on many AWS certs, former AWS practice lead (and partnership global alliance lead)? Couple that with three decades in Linux, Open Source, Networking (including founding Australia’s premier non-profit for internet advocacy and industry connectivity services (link)?

I am available for Well-Architected Framework Reviews of client environments. I am happy to come on site to your location and work with customers existing teams, helping identify the opportunities for improvement. Not only do we walk through the focus pillars of the Well-Architected tool, but also do some high level network security observations, and help identify tasks and direction that will help yield long term success.

I am also available for advisory work, should you need a senior experienced engineer who can help provide clarity around Cloud and modern technology operations.

While I am in Perth, Western Australia, I am open to clients across Australia, or worldwide. De plus, je parle français, ce qui couvre également tous les pays francophones.

For more information, check out https://nephology.net.au/, and please have an obligation-free chat with me. Email is on the Nephology website (though I suspect many of you have me on LinkedIn or my direct mobile in your address book).

A new class of AWS Certification

AWS announced today not just a new AWS Certification, but a new class of certification: Business. The specific certification is called the “AWS Certified AI Business Strategist – Business”.

This certification is open in beta now, as can be seen from the Cert Metrics portal:

Until February 2027, this USD$100 certification is half price to US$50. AWS claims no technical experience is necessary, and this certification is suitable for roles that are “Product and program managers, sales and business development professionals, line-of-business leaders, consultants and business analysts, marketing professionals”.

This brings back to 12 the number of available AWS certifications:

  • Foundational (2):
    • Cloud Practitioner
    • AI Practitioner
  • Associate: (5)
    • Solution Architect
    • CloudOps (was SysOps)
    • Developer
    • Data Engineer
    • Machine Learning Engineer
  • Professional (3):
    • Solution Architect
    • DevOps Engineer
    • Generative AI Developer
  • Specialty (2):
    • Security
    • Networking – was to be retired already, now retirement rescheduled to December 2026

Given a new class of certification, we can perhaps expect to see more certifications in the category. There’s long been rumours (circling back over 6+ years) of a FinOps certification that’s not seen the light of day yet – perhaps that would fit in this class.

As noted above, the Networking – Specialty certification was recently given a slight reprieve from being axed. It had been announced it was ending 25 August 2026, but that’s pushed out to 31 December 2026. AWS Networking is continuing to evolve and expand – particularly with managed interconnect to alternate hyperscaler cloud providers. Many comments I have seen are from engineers who feel that the content in this certification is important, and not covered by any other certification, and that remove this would be a loss, to which I agree. However, I am biased as I have contributed many questions to this certification over the last decade as one of the volunteer AWS Certification Subject Matter Experts.

Some questions I have from this:

  • With 12 certifications back available, does this restore the golden jacket requirement to be “all 12” again?
  • Does achieving the AI Strategist – Business certification re-certify and extend any Foundational certifications the person may have (eg Cloud Practitioner)?

As always, there is a set of AWS certifications for each audience in an organisation, and I don’t expect most people to go and achieve all of them – but the subset that are most applicable to their role.