# 400 bad request errors **URL:** \ **Category:** NGINX\ **Created:** [September 28, 2009, 4:15pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286 "2009-09-28T16:15:48Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [September 28, 2009, 4:15pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/1 "2009-09-28T16:15:48Z")
hi i have several errors in my access\_log IP \_ - [28/Sep/2009:15:56:33 +0200] “-” 400 0 “-” “-” “-” why these errors occur? thanks!!! Posted at Nginx Forum: > **[400 bad request errors](https://forum.nginx.org/read.php?2,9695,9695#msg-9695)** > > hi i have several errors in my access\_log IP \_ - \[28/Sep/2009:15:56:33 +0200\] "-" 400 0 "-" "-" "-" why these errors occur? thanks!!!!!! ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [September 28, 2009, 4:33pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/2 "2009-09-28T16:33:58Z")
Hello! On Mon, Sep 28, 2009 at 10:07:25AM -0400, pepejose wrote: > hi > > i have several errors in my access\_log > > IP \_ - [28/Sep/2009:15:56:33 +0200] “-” 400 0 “-” “-” “-” > > why these errors occur? These errors are “400 Bad Request”, most likely just client connects without sending anything. Some load balancers / health checks known to cause a lots of these. Maxim D. ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [September 28, 2009, 4:42pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/3 "2009-09-28T16:42:45Z")
I’ve been getting plenty of these too, and all originating from different IPs in my ISP. Think the load balancer possibility doesn’t really answer for my case. Does anyone else have any other answers on this? Ray ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [September 28, 2009, 4:49pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/4 "2009-09-28T16:49:46Z")
I have to worry about? Logwatch says A total of XXX sites probed the server and if I look at those ip access log I see Error 400 thank you very much! Posted at Nginx Forum: > **[Re: 400 bad request errors](https://forum.nginx.org/read.php?2,9695,9706#msg-9706)** > > hi i have several errors in my access\_log IP \_ - \[28/Sep/2009:15:56:33 +0200\] "-" 400 0 "-" "-" "-" why these errors occur? thanks!!!!!! ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [September 28, 2009, 4:57pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/5 "2009-09-28T16:57:58Z")
Hello! On Mon, Sep 28, 2009 at 10:44:26AM -0400, pepejose wrote: > I have to worry about? Logwatch says A total of XXX sites probed the server and > if I look at those ip access log I see Error 400 No, there is nothing to worry about. Such errors are more or less normal, they will happen eventually under normal load. Big percent of such errors may indicate network problems, but you’ll probably notice it from other (and more reliable) information sources as well. Maxim D. ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 1, 2009, 10:22am UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/6 "2009-10-01T10:22:21Z")
hello again! jeje well, I’ve been watching the logs again and the report of Logwatch, now with nginx as reverse proxy in front of apache I have in one hour 441 “NULL 400 Bad Requests” made by 45 ips aprox example: 17 connections: same ip, same second IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-” These amounts are normal with nginx? how can I know the causes of this? What can I do? thanks!! thanks!! thanks!! Posted at Nginx Forum: > **[Re: 400 bad request errors](https://forum.nginx.org/read.php?2,9695,10431#msg-10431)** > > hi i have several errors in my access\_log IP \_ - \[28/Sep/2009:15:56:33 +0200\] "-" 400 0 "-" "-" "-" why these errors occur? thanks!!!!!! ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [September 28, 2009, 5:09pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/7 "2009-09-28T17:09:06Z")
## Maxim D. Wrote: > are more or less > normal, they will happen eventually under normal > load. > > Big percent of such errors may indicate network > problems, but > you’ll probably notice it from other (and more > reliable) > information sources as well. > > Maxim D. ok! thanks!! Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,9695,9708#msg-9708](http://forum.nginx.org/read.php?2,9695,9708#msg-9708) ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 5:12pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/8 "2009-10-06T17:12:25Z")
## pepejose Wrote: > IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” > “-” “-” > IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” > “-” “-” > > These amounts are normal with nginx? > how can I know the causes of this? > What can I do? > > thanks!! thanks!! thanks!! I’ve been looking at the error.log this is the type of error that causes these entries in the access.log 2009/10/05 18:26:12 31810#0: \*29604 client closed prematurely connection while reading client request line, client: IP, server: \_ in my configuration file I have the following virtualhost: ``` server { ``` listen \*:80; server\_name \_; #default return 444; } then, why a request without host header generating a response 400 (bad request) and not a 444 as in the case if there is the host header but there is no virtualhost defined with same host? thanks!!! Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,9695,11519#msg-11519](http://forum.nginx.org/read.php?2,9695,11519#msg-11519) ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 5:12pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/9 "2009-10-06T17:12:25Z")
telnet ip port access.log MyIP \_ - [06/Oct/2009:16:46:06 +0200] “\x03” 400 166 “-” “-” “-” error.log 2009/10/06 16:46:06 5452#0: \*524221 client sent invalid method while reading client request line, client: MyIP, server: \_, request: “” thanks for your help! Posted at Nginx Forum: > **[Re: 400 bad request errors](https://forum.nginx.org/read.php?2,9695,11527#msg-11527)** > > hi i have several errors in my access\_log IP \_ - \[28/Sep/2009:15:56:33 +0200\] "-" 400 0 "-" "-" "-" why these errors occur? thanks!!!!!! ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 5:12pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/10 "2009-10-06T17:12:25Z")
On Tue, Oct 06, 2009 at 10:19:04AM -0400, pepejose wrote: > > IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” > > “-” “-” > > IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” > > listen \*:80; > server\_name \_; #default > return 444; > } > > then, why a request without host header generating a response 400 (bad request) and not a 444 as in the case if there is the host header but there is no virtualhost defined with same host? Do the following: * * * ## telnet you.host 80 ^D or * * * ## telnet you.host 80 ^] quit then look in logs. ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 5:24pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/11 "2009-10-06T17:24:09Z")
## pepejose Wrote: > invalid method while reading client request line, > client: MyIP, server: \_, request: “” > > thanks for your help! sorry, I forgot ^ D here is access.log MyIP \_ - [06/Oct/2009:17:03:31 +0200] “^” 400 166 “-” “-” “-” error.log 2009/10/06 17:03:31 5452#0: \*537681 client sent invalid method while reading client request line, client: MyIP, server: \_, request: “^” Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,9695,11529#msg-11529](http://forum.nginx.org/read.php?2,9695,11529#msg-11529) ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 5:26pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/12 "2009-10-06T17:26:29Z")
On Tue, Oct 06, 2009 at 10:56:20AM -0400, pepejose wrote: > thanks for your help! > I meant "Ctrl-D and Ctrl-] in “^D” and “^]”. Anyway, these bad requests are caused 400 error much early than “return 444”. ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 5:59pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/13 "2009-10-06T17:59:52Z")
> [Igor Sysoev](http://sysoev.ru/en/) > then, in the wiki says this “The basic name of server is used in an HTTP redirects, if no Host header was in client request or that header does not match any assigned server\_name” the response is HTTP 444 if there is the host header but there is no virtualhost defined with same host but 400 bad request when no header host in request, however, the sever field equals “\_” and not empty all this because every day I have many entries in the access.log like this and want to find out why: > > “-” “-” > > IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” > > “-” “-” > > IP \_ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” > > etc … Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,9695,11538#msg-11538](http://forum.nginx.org/read.php?2,9695,11538#msg-11538) ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 6:51pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/14 "2009-10-06T18:51:23Z")
On Tue, Oct 06, 2009 at 11:53:19AM -0400, pepejose wrote: > > [Igor Sysoev](http://sysoev.ru/en/) > > then, > > in the wiki says this > > “The basic name of server is used in an HTTP redirects, if no Host header was in client request or that header does not match any assigned server\_name” > > the response is HTTP 444 if there is the host header but there is no virtualhost defined with same host > but 400 bad request when no header host in request, however, the sever field equals “\_” and not empty If nginx gets empty request (no any symbol at all) and does not even try to search virtualhost, etc. It just returns 400. > all this because every day I have many entries in the access.log like this and want to find out why: I’ve shown the ways to emulate such requests: “telnet host 80”, then press Ctrl-D. It may be some scanners. It may be browser that has started an images download and has stopped the connection, because user has clicked on a link. ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 6, 2009, 7:15pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/15 "2009-10-06T19:15:23Z")
> > It may be browser that has started an images > > download and has stopped the connection, because user has clicked on a link. I thought that in this case, the response was HTTP 499 [ NGINX\_HTTP\_CLIENT\_CLOSED\_REQUEST ] with this in the configuration file, the behavior would be the same? server { server\_name “”; return 444; } thanks. Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,9695,11566#msg-11566](http://forum.nginx.org/read.php?2,9695,11566#msg-11566) ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 7, 2009, 5:21pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/16 "2009-10-07T17:21:21Z")
On Wed, Oct 07, 2009 at 10:57:57AM -0400, pepejose wrote: > I use nginx 0.7.61 (with patch to fix VU#180065) > > I read this in the wiki > > \<\< Since nginx 0.7.12, an empty server name is supported, to catch the requests without “Host” header. \>\> > > however, I get this error “the first server name must not be empty” then I can not catch these requests You may set ``` server_name _ ""; ``` “\_” is just unexistant name. ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 7, 2009, 5:09pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/17 "2009-10-07T17:09:38Z")
I use nginx 0.7.61 (with patch to fix VU#180065) I read this in the wiki \<\< Since nginx 0.7.12, an empty server name is supported, to catch the requests without “Host” header. \>\> however, I get this error “the first server name must not be empty” then I can not catch these requests thanks Posted at Nginx Forum: > **[Re: 400 bad request errors](https://forum.nginx.org/read.php?2,9695,11844#msg-11844)** > > hi i have several errors in my access\_log IP \_ - \[28/Sep/2009:15:56:33 +0200\] "-" 400 0 "-" "-" "-" why these errors occur? thanks!!!!!! ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 8, 2009, 8:45am UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/18 "2009-10-08T08:45:10Z")
everything is now working verysmoothly now…thanks for the great help you gave… thanks Posted at Nginx Forum: > **[Re: 400 bad request errors](https://forum.nginx.org/read.php?2,9695,12023#msg-12023)** > > hi i have several errors in my access\_log IP \_ - \[28/Sep/2009:15:56:33 +0200\] "-" 400 0 "-" "-" "-" why these errors occur? thanks!!!!!! ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 8, 2009, 5:15pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/19 "2009-10-08T17:15:04Z")
## cdan18po Wrote: > everything is now working verysmoothly > now…thanks for the great help you gave… > thanks WTF?! with this: ``` server { ``` listen \*:80; server\_name \_ “”; #default return 444; } and “telnet host port” + “Ctrl-D” I can not catch requests without host header I also read this thread which speaks about > **['Empty server name argument - Can't get it to work' - MARC](https://marc.info/?l=nginx&m=121991334206140&w=2)** thanks!! Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,9695,12084#msg-12084](http://forum.nginx.org/read.php?2,9695,12084#msg-12084) ---
**Author:** ![pepejose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/58f4c7/32.png) [@pepejose](https://www.ruby-forum.com/u/pepejose)\ **Post date:** [October 8, 2009, 5:32pm UTC](https://www.ruby-forum.com/t/400-bad-request-errors/176286/20 "2009-10-08T17:32:03Z")
On Thu, Oct 08, 2009 at 09:59:51AM -0400, pepejose wrote: > ``` > server { > > ``` > > listen \*:80; > server\_name \_ “”; #default > return 444; > } > > and “telnet host port” + “Ctrl-D” > > I can not catch requests without host header > > I also read this thread which speaks about ['Empty server name argument - Can't get it to work' - MARC](http://marc.info/?l=nginx&m=121991334206140&w=2) ‘server\_name \_ “”;’ does not make the server default. You have to set default server for listen pair: ``` server { ``` - listen \*:80; - listen \*:80 default; server\_name \_ “”; return 444; } However, if nginx has got empty request it will not run “return 444”, you will see 400 in access\_log.