# I see unusual amount of 408 errors from access log

**URL:** <https://www.ruby-forum.com/t/i-see-unusual-amount-of-408-errors-from-access-log/235259>\
**Category:** NGINX\
**Created:** [June 10, 2013, 2:22pm UTC](https://www.ruby-forum.com/t/i-see-unusual-amount-of-408-errors-from-access-log/235259 "2013-06-10T14:22:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [June 10, 2013, 2:22pm UTC](https://www.ruby-forum.com/t/i-see-unusual-amount-of-408-errors-from-access-log/235259/1 "2013-06-10T14:22:25Z")

</div>

/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:01:20  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:10:57  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:16:55  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:18:31  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:21:54  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:25:57  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:33:43  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:36:02  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:36:21  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:49:05  
+0000]  
“-” 408 0 “-” “-”  
/var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:55:31  
+0000]  
“-” 408 0 “-” “-”

As you can see, the log doesn’t contain any information about request,  
like  
request method and request uri. A normal access log should like this:

/var/log/nginx/nost\_access.log.1:x.x.x.x - - [09/Jun/2013:22:49:58  
+0000]  
“POST /some/resource/3984/upload/ HTTP/1.1” 408 0 “-”  
“APIClient-Android-16#v0.8.6”

My question is, why some access log entries have no request method/uri?  
I  
guess the 408 occurs in a early phase when the request entry is not  
processed yet. Since I’m enable HTTPS, is that can be a reason about  
this  
error?

My Nginx version is 1.2.1.

Thanks.

Posted at Nginx Forum:

> **[I see unusual amount of 408 errors from access log](https://forum.nginx.org/read.php?2,240003,240003#msg-240003)**
>
> /var/log/nginx/nost\_access.log.1:x.x.x.x - - \[10/Jun/2013:09:01:20 +0000\] "-" 408 0 "-" "-" /var/log/nginx/nost\_access.log.1:x.x.x.x - - \[10/Jun/2013:09:10:57 +0000\] "-" 408 0 "-" "-"...

---

<div class="post-metadata">

**Author:** ![xiaowl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/cab0a1/32.png) [@xiaowl](https://www.ruby-forum.com/u/xiaowl)\
**Post date:** [June 10, 2013, 2:29pm UTC](https://www.ruby-forum.com/t/i-see-unusual-amount-of-408-errors-from-access-log/235259/2 "2013-06-10T14:29:26Z")

</div>

Hello!

On Mon, Jun 10, 2013 at 08:21:47AM -0400, xiaowl wrote:

> /var/log/nginx/nost\_access.log.1:x.x.x.x - - [10/Jun/2013:09:25:57 +0000]  
> “-” 408 0 “-” “-”  
> processed yet. Since I’m enable HTTPS, is that can be a reason about this  
> error?
> 
> My Nginx version is 1.2.1.

These are https connections without anything sent (closed due to  
timeout). In 1.3.15+, such connections are no longer result in  
access\_log entries.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**

---

<div class="post-metadata">

**Author:** ![xiaowl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/cab0a1/32.png) [@xiaowl](https://www.ruby-forum.com/u/xiaowl)\
**Post date:** [June 10, 2013, 2:38pm UTC](https://www.ruby-forum.com/t/i-see-unusual-amount-of-408-errors-from-access-log/235259/3 "2013-06-10T14:38:12Z")

</div>

> My question is, why some access log entries have no request method/uri? I  
> guess the 408 occurs in a early phase when the request entry is not  
> processed yet.

It is usually generated by browsers (like Chrome  
[http://code.google.com/p/chromium/issues/detail?id=85229](http://code.google.com/p/chromium/issues/detail?id=85229) ) opening more  
sockets to the webserver (a way of “optimisation”) and not actually  
using  
them - eg not sending any http request.

rr
