# 400 errors **URL:** \ **Category:** NGINX\ **Created:** [December 8, 2010, 2:17am UTC](https://www.ruby-forum.com/t/400-errors/200263 "2010-12-08T02:17:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\ **Post date:** [December 8, 2010, 2:17am UTC](https://www.ruby-forum.com/t/400-errors/200263/1 "2010-12-08T02:17:57Z")
Hello, Something I’ve been seeing for a long time here - I’ve posted long ago, but was never able to find a solution. Looking at our access logs, I see tons of lines like (multiple times a minute) 123.45.6.789 - - [07/Dec/2010:19:05:51 -0600] “-” 400 0 “-” “-” I changed my error\_log to info, and I see a lot of corresponding entries like: recv() failed (104: Connection reset by peer) while reading client request line I also set the following, but it doesn’t seem to have helped, as I see a lot of posts about this issue potentially being caused by large cookies: large\_client\_header\_buffers 8 4k; Thoughts? Thanks! ``` Neil ``` ---
**Author:** ![unclouded](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/6bbea6/32.png) [@unclouded](https://www.ruby-forum.com/u/unclouded)\ **Post date:** [December 8, 2010, 5:20am UTC](https://www.ruby-forum.com/t/400-errors/200263/2 "2010-12-08T05:20:22Z")
2010/12/8 Neil S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > line > > I also set the following, but it doesn’t seem to have helped, as I see a lot > of posts about this issue potentially being caused by large cookies: > large\_client\_header\_buffers 8 4k; > > Thoughts? Hello, we used to have issues like this on two of our servers when the router was setup incorrectly and some ip packets of a TCP connection were routed not to the right server. Check your network. ---
**Author:** ![unclouded](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/6bbea6/32.png) [@unclouded](https://www.ruby-forum.com/u/unclouded)\ **Post date:** [December 8, 2010, 8:30am UTC](https://www.ruby-forum.com/t/400-errors/200263/3 "2010-12-08T08:30:13Z")
I think you may be on to something, we are definitely seeing some weirdness at a network level. I found an older thread of mine, forgot about it, this is the same problem. [http://nginx.org/pipermail/nginx/2008-December/008667.html](http://nginx.org/pipermail/nginx/2008-December/008667.html) We’re looking at the tcp/ip traffic in more detail, and things do not look correct . . . ---
**Author:** ![unclouded](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/6bbea6/32.png) [@unclouded](https://www.ruby-forum.com/u/unclouded)\ **Post date:** [December 10, 2010, 9:33am UTC](https://www.ruby-forum.com/t/400-errors/200263/4 "2010-12-10T09:33:05Z")
We just changed over to another server, so far I don’t see this issue happening, so perhaps it was indeed something related to some sort of faulty network config. I do still see some other 400s that I’m trying to track down. They’re almost all on the same page, it’s on a post request to our registration page. The entries all look like: 123.45.67.89 - - [09/Dec/2010:21:09:50 -0600] “POST /register.php HTTP/1.1” 400 0 “[Custom Application Development Software for Business - Salesforce.com](http://www.site.com/register.php?src=h)” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB6.6; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)” It generally seems to be IE that’s triggering these (but I see IE6, IE7, and IE8, so not limited to one version). I don’t find any corresponding errors in my backend apache logs, nor in the nginx error log. Any insights would be appreciated. Thanks! ---
**Author:** ![unclouded](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/6bbea6/32.png) [@unclouded](https://www.ruby-forum.com/u/unclouded)\ **Post date:** [December 8, 2010, 2:47am UTC](https://www.ruby-forum.com/t/400-errors/200263/5 "2010-12-08T02:47:59Z")
Hello! On Tue, Dec 07, 2010 at 05:17:03PM -0800, Neil S. wrote: > line > > I also set the following, but it doesn’t seem to have helped, as I see a lot > of posts about this issue potentially being caused by large cookies: > large\_client\_header\_buffers 8 4k; No, large cookies (as well as other large headers) will cause messages like “[info] … client sent too long header line”. Messages like “recv() failed” are likely due to aborted requests - e.g. users navigate away from your page before all images were loaded and browser closes unneeded connections. Causes are basically the same as ones for “accept() failed (53: Software caused connection abort)” messages[1]. Depending on your particular use case this may be either completely legitimate (i.e. it just happens often) or indicate some network problems (i.e. sending request takes long time so it happens often). Another possible cause is balancer “pings” which just open/close connection (and don’t send anything). This should be easily seen by surprisingly familiar client’s ip, though turned to be actual reason of the “400 errors” at least several times here. [1] [http://sysoev.ru/nginx/docs/faq.html](http://sysoev.ru/nginx/docs/faq.html) (in Russian) Maxim D. ---
**Author:** ![unclouded](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/6bbea6/32.png) [@unclouded](https://www.ruby-forum.com/u/unclouded)\ **Post date:** [December 10, 2010, 11:58am UTC](https://www.ruby-forum.com/t/400-errors/200263/6 "2010-12-10T11:58:46Z")
A little more info - if I set the error\_log to info, I see that these 400s correspond to “client closed prematurely connection” Given the volume of these I’m seeing, and only on this page (we aren’t really seeing many 400s on other pages), I don’t think it’s just an issue of the user clicking away before the page returns. ---
**Author:** ![unclouded](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/6bbea6/32.png) [@unclouded](https://www.ruby-forum.com/u/unclouded)\ **Post date:** [December 11, 2010, 12:39am UTC](https://www.ruby-forum.com/t/400-errors/200263/7 "2010-12-11T00:39:23Z")
Looking more at some of the specific IPs triggering this, I think it may be something automated. I see a lot of things like register-\>logout-\>register-\>logout - I think it’s trying to create accounts automatically. Still not sure what the actual failure is though. ---
**Author:** ![unclouded](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/6bbea6/32.png) [@unclouded](https://www.ruby-forum.com/u/unclouded)\ **Post date:** [December 10, 2010, 11:43am UTC](https://www.ruby-forum.com/t/400-errors/200263/8 "2010-12-10T11:43:01Z")
(We’re running 0.8.53.)