Hello,
Something I’ve been seeing for a long time here - I’ve posted long ago,
but
was never able to find a solution. Looking at our access logs, I see
tons
of lines like (multiple times a minute)
123.45.6.789 - - [07/Dec/2010:19:05:51 -0600] “-” 400 0 “-” “-”
I changed my error_log to info, and I see a lot of corresponding entries
like:
recv() failed (104: Connection reset by peer) while reading client
request
line
I also set the following, but it doesn’t seem to have helped, as I see a
lot
of posts about this issue potentially being caused by large cookies:
large_client_header_buffers 8 4k;
Thoughts?
Thanks!
Neil
2010/12/8 Neil S. [email protected]:
line
I also set the following, but it doesn’t seem to have helped, as I see a lot
of posts about this issue potentially being caused by large cookies:
large_client_header_buffers 8 4k;
Thoughts?
Hello,
we used to have issues like this on two of our servers when the router
was setup incorrectly and some ip packets of a TCP connection were
routed not to the right server. Check your network.
I think you may be on to something, we are definitely seeing some
weirdness
at a network level. I found an older thread of mine, forgot about it,
this
is the same problem.
http://nginx.org/pipermail/nginx/2008-December/008667.html
We’re looking at the tcp/ip traffic in more detail, and things do not
look
correct . . .
We just changed over to another server, so far I don’t see this issue
happening, so perhaps it was indeed something related to some sort of
faulty
network config.
I do still see some other 400s that I’m trying to track down. They’re
almost all on the same page, it’s on a post request to our registration
page. The entries all look like:
123.45.67.89 - - [09/Dec/2010:21:09:50 -0600] “POST /register.php
HTTP/1.1”
400 0 “Custom Application Development Software for Business - Salesforce.com” “Mozilla/4.0 (compatible;
MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB6.6; SLCC2; .NET CLR
2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)”
It generally seems to be IE that’s triggering these (but I see IE6, IE7,
and
IE8, so not limited to one version). I don’t find any corresponding
errors
in my backend apache logs, nor in the nginx error log.
Any insights would be appreciated.
Thanks!
Hello!
On Tue, Dec 07, 2010 at 05:17:03PM -0800, Neil S. wrote:
line
I also set the following, but it doesn’t seem to have helped, as I see a lot
of posts about this issue potentially being caused by large cookies:
large_client_header_buffers 8 4k;
No, large cookies (as well as other large headers) will cause
messages like “[info] … client sent too long header line”.
Messages like “recv() failed” are likely due to aborted requests
- e.g. users navigate away from your page before all images were
loaded and browser closes unneeded connections. Causes are
basically the same as ones for “accept() failed (53: Software
caused connection abort)” messages[1].
Depending on your particular use case this may be either
completely legitimate (i.e. it just happens often) or indicate
some network problems (i.e. sending request takes long time so it
happens often).
Another possible cause is balancer “pings” which just open/close
connection (and don’t send anything). This should be easily seen by
surprisingly familiar client’s ip, though turned to be actual
reason of the “400 errors” at least several times here.
[1] http://sysoev.ru/nginx/docs/faq.html (in Russian)
Maxim D.
A little more info - if I set the error_log to info, I see that these
400s
correspond to “client closed prematurely connection”
Given the volume of these I’m seeing, and only on this page (we aren’t
really seeing many 400s on other pages), I don’t think it’s just an
issue of
the user clicking away before the page returns.
Looking more at some of the specific IPs triggering this, I think it may
be
something automated. I see a lot of things like
register->logout->register->logout - I think it’s trying to create
accounts
automatically. Still not sure what the actual failure is though.