# KeepAlive Not Working as expected for a Reverse Proxy Scenario

**URL:** <https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732>\
**Category:** NGINX\
**Created:** [April 10, 2012, 12:54pm UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732 "2012-04-10T12:54:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [April 10, 2012, 12:54pm UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732/1 "2012-04-10T12:54:31Z")

</div>

Hi,

## The KeepAlive Timeout is set to 2 hours, but we can see that the connections start terminating after a few minutes. The KeepAlive module does not seems to be behaving as expected. The connections are created on port :343. The configuration file nginx.conf is :-

user nginx;  
worker\_processes 16;  
error\_log /var/log/nginx/error.log info;  
pid /var/run/nginx.pid;  
events {  
#worker\_connections 16192;  
#worker\_connections 161920;  
worker\_connections 40960;  
use epoll;  
multi\_accept on;  
}  
http {  
include /etc/nginx/mime.types;  
default\_type application/octet-stream;  
log\_format main '$remote\_addr - $remote\_user [$time\_local]  
“$request”  
’  
'$status $body\_bytes\_sent “$http\_referer” ’  
‘“$http\_user\_agent” “$http\_x\_forwarded\_for”’;  
access\_log /var/log/nginx/access.log main;  
sendfile on;  
#tcp\_nopush on;  
keepalive\_timeout 7200 7200;  
tcp\_keepalive on;  
tcp\_keepcnt 10;  
tcp\_keepidle 3600;  
tcp\_keepintvl 1m;  
#gzip on;

```
#
# The default server
#
    server {
            listen 4443;
            server_name _;
            location /nginx_status {

```

# copied from

[http://blog.kovyrin.net/2006/04/29/monitoring-nginx-with-rrdtool/](http://blog.kovyrin.net/2006/04/29/monitoring-nginx-with-rrdtool/)  
stub\_status on;  
access\_log off;  
}  
}  
server {  
listen 80;  
server\_name \_;  
# keepalive\_timeout 7200 7200;  
#charset koi8-r;  
access\_log logs/host.access.log main;  
location / {  
proxy\_pass [http://172.31.253.50:180/](http://172.31.253.50:180/);  
include /etc/nginx/proxy.conf;  
}  
}  
server {  
listen 443 ssl;  
ssl on;  
ssl\_verify\_client on;  
server\_name \_;  
ssl\_certificate /home/rsiwal/cps.chargepoint.net.crt;  
#ssl\_client\_certificate /etc/httpd/certs/  
[chargepoint.net/server/certs/cps.chargepoint.net.crt](http://chargepoint.net/server/certs/cps.chargepoint.net.crt);  
ssl\_client\_certificate /home/rsiwal/chargepoint.net.crt;  
ssl\_certificate\_key /home/rsiwal/cps.chargepoint.net.pem;  
location / {  
proxy\_pass [http://172.31.253.50:1443/](http://172.31.253.50:1443/);  
include /etc/nginx/proxy.conf;  
}  
}  
server {  
listen 343 ssl;  
ssl on;  
ssl\_verify\_client on;  
server\_name \_;  
#ssl\_session\_cache shared:SSL:40m; # Works fine upto 15K  
ssl\_session\_cache shared:SSL:70m;  
#######ssl\_session\_timeout 5m; #  
ssl\_session\_timeout 120m; #  
tcp\_keepalive on;  
tcp\_keepcnt 10;  
tcp\_keepidle 7200;  
tcp\_keepintvl 1m;  
access\_log logs/ssl-access.log main;  
error\_log logs/ssl-error.log debug;  
keepalive\_requests 10000;  
#keepalive\_disable none  
sendfile on;  
tcp\_nopush on;  
tcp\_nodelay on;  
client\_header\_timeout 300;  
client\_body\_timeout 300;  
ssl\_certificate /home/rsiwal/cps.chargepoint.net.crt;  
ssl\_certificate\_key /home/rsiwal/cps.chargepoint.net.pem;  
ssl\_client\_certificate /home/rsiwal/chargepoint.net.crt;  
location / {  
proxy\_pass [http://172.31.253.50:1343/](http://172.31.253.50:1343/);  
include /etc/nginx/proxy.conf;  
}  
}  
include /etc/nginx/conf.d/\*.conf;  
}

---

<div class="post-metadata">

**Author:** ![Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/87869e/32.png) [@Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/u/Rajnesh_Kumar_Siwal)\
**Post date:** [April 10, 2012, 3:03pm UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732/2 "2012-04-10T15:03:35Z")

</div>

Hello!

On Tue, Apr 10, 2012 at 04:23:14PM +0530, Rajnesh Kumar Siwal wrote:

> The KeepAlive Timeout is set to 2 hours, but we can see that the  
> connections start terminating after a few minutes.  
> The KeepAlive module does not seems to be behaving as expected.  
> The connections are created on port :343.  
> The configuration file nginx.conf is :-

[…]

> ```
> keepalive_timeout 7200 7200;
> 
> ```

How do you test?

Note: many (most?) browsers won’t keep connections open for such a  
long time and will close them after a minute or so. E.g. Chrome  
unconditionally closes connections after 5 minutes.

Note well: nginx itself might close keepalive connections before  
timeout passes if it’s short on worker\_connections. Though I  
suppose you are hitting browsers behaviour instead.

Maxim D.

---

<div class="post-metadata">

**Author:** ![Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/87869e/32.png) [@Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/u/Rajnesh_Kumar_Siwal)\
**Post date:** [April 10, 2012, 3:04pm UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732/3 "2012-04-10T15:04:12Z")

</div>

On Tuesday 10 April 2012 14:53:14 Rajnesh Kumar Siwal wrote:

> Hi,
> 
> The KeepAlive Timeout is set to 2 hours, but we can see that the  
> connections start terminating after a few minutes.  
> The KeepAlive module does not seems to be behaving as expected.

So, what’s in the error log? Are you sure that the client doesn’t close  
the  
connection? Some browsers actually do after a minute or few.

[…]

> tcp\_keepalive on;  
> tcp\_keepcnt 10;  
> tcp\_keepidle 7200;  
> tcp\_keepintvl 1m;

There are no such directives in the official nginx distribution. But you  
can set  
SO\_KEEPALIVE by parameter of the listen directive:

listen 443 ssl so\_keepalive=2h:1m:10;

Please, take a look at the docs: [Module ngx\_http\_core\_module](http://nginx.org/r/listen)

wbr, Valentin V. Bartenev

---

<div class="post-metadata">

**Author:** ![Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/87869e/32.png) [@Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/u/Rajnesh_Kumar_Siwal)\
**Post date:** [April 11, 2012, 7:41am UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732/4 "2012-04-11T07:41:30Z")

</div>

Thanks Valentin, but it still is not accepting the parameters:-

[removed\_email\_address@domain.invalid2 conf]# /etc/init.d/nginxfromsrc start  
Starting nginx: nginx: [emerg] invalid parameter “so\_keepalive=2h:1m:10”  
in  
/usr/local/nginx-1.0.14/conf/nginx.conf:  
96

Secondly, I don’t see the message that the client is terminating the  
connections.  
In case I use elinks to open the URL and close it, it displays me that  
the  
KeepAlive connection is terminated by the client.  
So, I am pretty sure that the connections are not terminated by the  
client.

Additionally, we are using CURL library to check it.  
We have a simulator that create the connections and sends data using  
CURL  
library.  
The same scenario is working fine with Apache and the connections are  
persistent.

On Tue, Apr 10, 2012 at 4:23 PM, Rajnesh Kumar Siwal \<

---

<div class="post-metadata">

**Author:** ![Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/87869e/32.png) [@Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/u/Rajnesh_Kumar_Siwal)\
**Post date:** [April 11, 2012, 1:05pm UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732/5 "2012-04-11T13:05:21Z")

</div>

On Wednesday 11 April 2012 09:40:18 Rajnesh Kumar Siwal wrote:

> Thanks Valentin, but it still is not accepting the parameters:-
> 
> [removed\_email\_address@domain.invalid2 conf]# /etc/init.d/nginxfromsrc start  
> Starting nginx: nginx: [emerg] invalid parameter “so\_keepalive=2h:1m:10” in  
> /usr/local/nginx-1.0.14/conf/nginx.conf:  
> 96

It’s no coincidence I asked to take a look at the documentation, you  
also  
need nginx 1.1.11 or above.

> Secondly, I don’t see the message that the client is terminating the  
> connections.

What’s in the error logs?

> In case I use elinks to open the URL and close it, it displays me that the  
> KeepAlive connection is terminated by the client.  
> So, I am pretty sure that the connections are not terminated by the client.
> 
> Additionally, we are using CURL library to check it.  
> We have a simulator that create the connections and sends data using CURL  
> library.  
> The same scenario is working fine with Apache and the connections are  
> persistent.

Could you provide debug log?

> **[A debugging log](http://nginx.org/en/docs/debugging_log.html)**

wbr, Valentin V. Bartenev

---

<div class="post-metadata">

**Author:** ![Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/87869e/32.png) [@Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/u/Rajnesh_Kumar_Siwal)\
**Post date:** [April 12, 2012, 9:01pm UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732/6 "2012-04-12T21:01:04Z")

</div>

Thanks Valentin, I have compiled 1.1.18.  
Can we consider the development release 1.1.18 to be stable ?  
Will it be safe to use it in production environment ?

---

<div class="post-metadata">

**Author:** ![Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/87869e/32.png) [@Rajnesh\_Kumar\_Siwal](https://www.ruby-forum.com/u/Rajnesh_Kumar_Siwal)\
**Post date:** [April 12, 2012, 9:36pm UTC](https://www.ruby-forum.com/t/keepalive-not-working-as-expected-for-a-reverse-proxy-scenario/218732/7 "2012-04-12T21:36:32Z")

</div>

On Thursday 12 April 2012 23:00:09 Rajnesh Kumar Siwal wrote:

> Thanks Valentin, I have compiled 1.1.18.  
> Can we consider the development release 1.1.18 to be stable ?  
> Will it be safe to use it in production environment ?

Nginx “stable” branch provides API and behavior stability. Both branches  
are  
reliable to use in production, but when you use “devel” you should read  
change  
logs slightly more careful before update to the new version.

You may consider to update to the 1.1.19 which was released today,  
especially if  
you use mp4 module, because of security issue:

[[nginx-announce] security advisory](http://mailman.nginx.org/pipermail/nginx-announce/2012/000080.html)

Also note, that the 1.1 “devel” branch will become 1.2, the new “stable”  
in a  
few weeks:

[http://trac.nginx.org/nginx/roadmap](http://trac.nginx.org/nginx/roadmap)

wbr, Valentin V. Bartenev