# Possible HTTP response read bug in Nginx 1.0.12 **URL:** \ **Category:** NGINX\ **Created:** [April 3, 2012, 1:07pm UTC](https://www.ruby-forum.com/t/possible-http-response-read-bug-in-nginx-1-0-12/218528 "2012-04-03T13:07:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\ **Post date:** [April 3, 2012, 1:07pm UTC](https://www.ruby-forum.com/t/possible-http-response-read-bug-in-nginx-1-0-12/218528/1 "2012-04-03T13:07:59Z")
Hi, I’ve nginx server setup that terminates SSL connections from clients and forwards plain HTTP requests to backend servers. Some of these requests can last pretty long (up to 1 minute) and usually get very short 15 byte reply. (Ajax polling) However, we see often these kind of errors that indicate that backend servers would have disconnected socket while writing reply. 2012/03/03 06:46:38 [error] 13394#0: \*2100 upstream prematurely closed connection while reading response header from upstream, client: XX.XX.XX.XX, server: [secure.example.com](http://secure.example.com), request: “GET /url/example?par=12345 HTTP/1.1”, upstream: “[http://127.0.0.1:8082/url/example?par=12345](http://127.0.0.1:8082/url/example?par=12345)”, host: “[secure.example.com](http://secure.example.com)”, referrer: “[https://secure.example.com/](https://secure.example.com/)” Strangely I can see correponding 200 OK responses from our server logs at the same timestamp, so at least backend server is trying to respond correctly. Then we captured the traffic between nginx and backend server with wireshark and noticed that when this happens the response from server is actually sent in two TCP packets. The first packet has headers and the second packet has small 15 byte HTTP body. I suspect that nginx fails to read the second packet in some conditions and thinks backend server disconnected prematurely. Any insights? Thanks! Posted at Nginx Forum: > **[Possible HTTP response read bug in Nginx 1.0.12](https://forum.nginx.org/read.php?2,224853,224853#msg-224853)** > > Hi, I've nginx server setup that terminates SSL connections from clients and forwards plain HTTP requests to backend servers. Some of these requests can last pretty long (up to 1 minute) and usually get very short 15 byte reply. (Ajax polling)... ---
**Author:** ![tikonen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/2acd7d/32.png) [@tikonen](https://www.ruby-forum.com/u/tikonen)\ **Post date:** [April 3, 2012, 6:16pm UTC](https://www.ruby-forum.com/t/possible-http-response-read-bug-in-nginx-1-0-12/218528/2 "2012-04-03T18:16:35Z")
Hello! On Tue, Apr 03, 2012 at 07:07:04AM -0400, tikonen wrote: > 2012/03/03 06:46:38 [error] 13394#0: \*2100 upstream prematurely closed > wireshark and noticed that when this happens the response from server is > actually sent in two TCP packets. > > The first packet has headers and the second packet has small 15 byte > HTTP body. I suspect that nginx fails to read the second packet in some > conditions and thinks backend server disconnected prematurely. > > Any insights? Thanks! Please try 1.1.x to see if this is already resolved. If not, please provide traffic capture and corresponding debug log, see > **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)** > > ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com Maxim D. ---
**Author:** ![tikonen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/2acd7d/32.png) [@tikonen](https://www.ruby-forum.com/u/tikonen)\ **Post date:** [April 4, 2012, 3:06am UTC](https://www.ruby-forum.com/t/possible-http-response-read-bug-in-nginx-1-0-12/218528/3 "2012-04-04T03:06:39Z")
Hi, Thanks for advice, I’ll try next with 1.1.X and see if that helps. In case 1.1.X does not solve the problem. Server load is pretty big and only minor % of requests have the error so the debug log and capture dump would be Huge to catch even one case. (Still these errors are frequent enough to cause ip\_hash to flag node failed and cause havoc in the cluster). To narrow down needed data, can you recommend proper debugging settings, should I start server or global level? Also, should I make debug log againts 1.1.X or 1.0.12 ? Thanks, Teemu ## Maxim D. Wrote: > Please try 1.1.x to see if this is already > resolved. If not, > please provide traffic capture and corresponding > debug log, see > [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/Debugging) Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,224853,224907#msg-224907](http://forum.nginx.org/read.php?2,224853,224907#msg-224907) ---
**Author:** ![tikonen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/2acd7d/32.png) [@tikonen](https://www.ruby-forum.com/u/tikonen)\ **Post date:** [April 4, 2012, 10:13am UTC](https://www.ruby-forum.com/t/possible-http-response-read-bug-in-nginx-1-0-12/218528/4 "2012-04-04T10:13:25Z")
I can confirm that problem exisits also with Nginx 1.1.18. Posted at Nginx Forum: > **[Re: Possible HTTP response read bug in Nginx 1.0.12](https://forum.nginx.org/read.php?2,224853,224917#msg-224917)** > > Hi, I've nginx server setup that terminates SSL connections from clients and forwards plain HTTP requests to backend servers. Some of these requests can last pretty long (up to 1 minute) and usually get very short 15 byte reply. (Ajax polling)... ---
**Author:** ![tikonen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/2acd7d/32.png) [@tikonen](https://www.ruby-forum.com/u/tikonen)\ **Post date:** [May 19, 2012, 4:29am UTC](https://www.ruby-forum.com/t/possible-http-response-read-bug-in-nginx-1-0-12/218528/5 "2012-05-19T04:29:39Z")
Running now on nginx 1.2.0 and haven’t seen this error anymore in normal production. Now I can see these errors only when non-gracefully restarting upstream nodes, but of course in this case these “prematurely closed” errors are expected and normal. Posted at Nginx Forum: > **[Re: Possible HTTP response read bug in Nginx 1.0.12](https://forum.nginx.org/read.php?2,224853,226651#msg-226651)** > > Hi, I've nginx server setup that terminates SSL connections from clients and forwards plain HTTP requests to backend servers. Some of these requests can last pretty long (up to 1 minute) and usually get very short 15 byte reply. (Ajax polling)... ---
**Author:** ![tikonen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/2acd7d/32.png) [@tikonen](https://www.ruby-forum.com/u/tikonen)\ **Post date:** [April 4, 2012, 1:10pm UTC](https://www.ruby-forum.com/t/possible-http-response-read-bug-in-nginx-1-0-12/218528/6 "2012-04-04T13:10:22Z")
Hello! On Tue, Apr 03, 2012 at 09:06:12PM -0400, tikonen wrote: > To narrow down needed data, can you recommend proper debugging settings, > should I start server or global level? It’s better to have debugging activated at global level to be able to see events reported by the kernel. > Also, should I make debug log againts 1.1.X or 1.0.12 ? The 1.1.x would be better. Maxim D.