# Socket leaks., pread and SSL\_Write() in 1.0.14

**URL:** <https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248>\
**Category:** NGINX\
**Created:** [March 26, 2012, 9:26am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248 "2012-03-26T09:26:53Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [March 26, 2012, 9:26am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/1 "2012-03-26T09:26:53Z")

</div>

Hi everyone,

I just wanted to let the developers know about some error flags I  
discovered into Nginx 1.0.14, with debug mode disabled.  
Socket leaks and pread:  
2012/03/24 23:29:52 [alert] 10770#0: open socket #46 left in connection  
5  
2012/03/24 23:29:52 [alert] 10770#0: open socket #115 left in connection  
54  
2012/03/24 23:29:52 [alert] 10770#0: open socket #110 left in connection  
107  
2012/03/24 23:29:52 [alert] 10770#0: aborting  
2012/03/24 23:29:52 [alert] 10772#0: open socket #44 left in connection  
57  
2012/03/24 23:29:52 [alert] 10772#0: open socket #38 left in connection  
140  
2012/03/24 23:29:52 [alert] 10772#0: aborting  
2012/03/25 00:01:35 [alert] 4105#0: \*14584 pread() read only 0 of 5733  
from “/var/www/domain.com/index.html” while sending response to client,  
client: xx.xxx.xx.xxx, server: [www.domain.com](http://www.domain.com), request: “GET /  
HTTP/1.1”, host: “[www.domain.com](http://www.domain.com)”

SSL\_Write()  
2012/03/25 12:59:25 [crit] 8254#0: \*342055 SSL\_write() failed (SSL:)  
while sending to client, client: xxx.xx.xxx.xxx, server: [www.domain.com](http://www.domain.com),  
request: “GET /community/attachments/info007-jpg.179371/ HTTP/1.1”,  
upstream: “fastcgi://127.0.0.1:9000”, host: “[www.domain.com](http://www.domain.com)”, referrer:  
“[https://www.domain.com/community/threads/photos.42232/](https://www.domain.com/community/threads/photos.42232/)”  
2012/03/25 14:52:15 [crit] 8253#0: \*388269 SSL\_write() failed (SSL:)  
while sending to client, client: xx.xxx.xx.xxx, server: [www.domain.com](http://www.domain.com),  
request: “GET /community/ HTTP/1.0”, upstream:  
“fastcgi://127.0.0.1:9000”, host: “[www.domain.com](http://www.domain.com)”

We are running Nginx on CentOS 5.8 64bits, with openssl 0.9.8e-22.el5.  
All ssl directives are located into host, only the ssl\_certificate and  
ssl\_certificate\_key are into server.

# uname -a

Linux [chronos.domain.com](http://chronos.domain.com) 2.6.18-274.18.1.el5 #1 SMP Thu Feb 9 12:45:44  
EST 2012 x86\_64 x86\_64 x86\_64 GNU/Linux

# nginx -V

nginx version: nginx/1.0.14  
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-52)  
TLS SNI support disabled  
configure arguments: --user=nginx --group=nginx  
–prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx  
–conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx.pid  
–error-log-path=/var/log/nginx/error.log  
–http-log-path=/var/log/nginx/access.log  
–http-client-body-temp-path=/var/lib/nginx/client  
–http-fastcgi-temp-path=/var/lib/nginx/fastcgi  
–http-proxy-temp-path=/var/lib/nginx/proxy  
–http-scgi-temp-path=/var/lib/nginx/scgi  
–http-uwsgi-temp-path=/var/lib/nginx/uwsgi  
–lock-path=/var/lock/subsys/nginx --with-cc-opt=‘-O3 -g -m64  
-mtune=nocona -m128bit-long-double -mmmx -msse3 -mfpmath=sse’  
–with-file-aio --with-http\_addition\_module --with-http\_dav\_module  
–with-http\_degradation\_module --with-http\_flv\_module  
–with-http\_geoip\_module --with-http\_gzip\_static\_module  
–with-http\_image\_filter\_module --with-http\_mp4\_module  
–with-http\_perl\_module --with-http\_random\_index\_module  
–with-http\_realip\_module --with-http\_secure\_link\_module  
–with-http\_ssl\_module --with-http\_stub\_status\_module  
–with-http\_sub\_module --with-http\_xslt\_module --with-mail  
–with-mail\_ssl\_module --with-poll\_module --with-rtsig\_module  
–with-select\_module

open\_file\_cache is enabled into http:  
open\_file\_cache max=1024 inactive=30s;  
open\_file\_cache\_errors on;  
open\_file\_cache\_min\_uses 2;  
open\_log\_file\_cache max=1024 inactive=30s min\_uses=2;

Posted at Nginx Forum:

> **[Socket leaks., pread and \[crit\] SSL\_Write() in 1.0.14](https://forum.nginx.org/read.php?2,224381,224381#msg-224381)**
>
> Hi everyone, I just wanted to let the developers know about some error flags I discovered into Nginx 1.0.14, with debug mode disabled. Socket leaks and pread: 2012/03/24 23:29:52 \[alert\] 10770#0: open socket #46 left in connection 5 2012/03/24...

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 26, 2012, 9:30am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/2 "2012-03-26T09:30:00Z")

</div>

This occurs randomly, it is not something constant.

Posted at Nginx Forum:

> **[Re: Socket leaks., pread and \[crit\] SSL\_Write() in 1.0.14](https://forum.nginx.org/read.php?2,224381,224382#msg-224382)**
>
> Hi everyone, I just wanted to let the developers know about some error flags I discovered into Nginx 1.0.14, with debug mode disabled. Socket leaks and pread: 2012/03/24 23:29:52 \[alert\] 10770#0: open socket #46 left in connection 5 2012/03/24...

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 26, 2012, 12:22pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/3 "2012-03-26T12:22:22Z")

</div>

Hello!

On Sun, Mar 25, 2012 at 11:55:53PM -0400, TECK wrote:

> 107  
> 2012/03/24 23:29:52 [alert] 10770#0: aborting  
> 2012/03/24 23:29:52 [alert] 10772#0: open socket #44 left in connection  
> 57  
> 2012/03/24 23:29:52 [alert] 10772#0: open socket #38 left in connection  
> 140  
> 2012/03/24 23:29:52 [alert] 10772#0: aborting

Do you see this as a regression from some previous version? If  
yes - which one? Do you see the same problem in 1.1.x?

> 2012/03/25 00:01:35 [alert] 4105#0: \*14584 pread() read only 0 of 5733  
> from “/var/www/domain.com/index.html” while sending response to client,  
> client: xx.xxx.xx.xxx, server: [www.domain.com](http://www.domain.com), request: “GET /  
> HTTP/1.1”, host: “[www.domain.com](http://www.domain.com)”

This usually happens if you update files non-atomically, i.e. edit  
files in-place instead of creating new file and then renaming it  
to desired name. Obvious solution is to update files atomically.

Note well: by using open\_file\_cache you allow much bigger time  
frame for non-atomic updates to trigger problems. If you can’t  
eliminate non-atomic updates it’s a good idea to avoid using  
open\_file\_cache.

> We are running Nginx on CentOS 5.8 64bits, with openssl 0.9.8e-22.el5.

As openssl 0.9.8e is quite old, I assume it’s heavily modified by  
your OS vendor. Do you see the same errors if you compile nginx with  
recent vanilla openssl (0.9.8u, 1.0.0h or 1.0.1 will be ok)?

[…]

Maxim D.

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 26, 2012, 2:05pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/4 "2012-03-26T14:05:01Z")

</div>

Hi Maxim,

> Do you see this as a regression from some previous version? If  
> yes - which one? Do you see the same problem in 1.1.x?

I used before 1.0.12 and did not experienced the socket leaks.

> This usually happens if you update files non-atomically, i.e. edit  
> files in-place instead of creating new file and then renaming it  
> to desired name. Obvious solution is to update files atomically.

Thanks, that is what I was doing, editing the file with nano. 🙂

> As openssl 0.9.8e is quite old, I assume it’s heavily modified by  
> your OS vendor. Do you see the same errors if you compile nginx with  
> recent vanilla openssl (0.9.8u, 1.0.0h or 1.0.1 will be ok)?

We are using the default openssl version available in CentOS 5.8.  
I could look into that but we are talking hundreds of thousands of  
servers still using 0.9.8e.  
Personally I’m not comfortable yet moving to CentOS 6.2. I will create  
an openssl-1.0.1 RPM for CentOS 5.8 and test it on a development server,  
then move it into production. Still, I don’t recall noticing any SSL  
errors on previous Nginx version (1.0.12).

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,224381,224410#msg-224410](http://forum.nginx.org/read.php?2,224381,224410#msg-224410)

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 26, 2012, 2:50pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/5 "2012-03-26T14:50:19Z")

</div>

I looked into upgrading to 1.0.1, it is not possible. We are talking  
about 84 package deps, on a minimal install. So upgrading openssl is not  
viable.

Posted at Nginx Forum:

> **[Re: Socket leaks., pread and \[crit\] SSL\_Write() in 1.0.14](https://forum.nginx.org/read.php?2,224381,224416#msg-224416)**
>
> Hi everyone, I just wanted to let the developers know about some error flags I discovered into Nginx 1.0.14, with debug mode disabled. Socket leaks and pread: 2012/03/24 23:29:52 \[alert\] 10770#0: open socket #46 left in connection 5 2012/03/24...

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 26, 2012, 6:48pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/6 "2012-03-26T18:48:46Z")

</div>

Hello!

On Mon, Mar 26, 2012 at 08:04:13AM -0400, TECK wrote:

> Hi Maxim,
> 
> > Do you see this as a regression from some previous version? If  
> > yes - which one? Do you see the same problem in 1.1.x?
> 
> I used before 1.0.12 and did not experienced the socket leaks.

That’s really strange, changes between 1.0.12 and 1.0.14 are  
minimal. Could you please re-try with 1.0.12 to see if it works  
for you without problems?

> > As openssl 0.9.8e is quite old, I assume it’s heavily modified by  
> > your OS vendor. Do you see the same errors if you compile nginx with  
> > recent vanilla openssl (0.9.8u, 1.0.0h or 1.0.1 will be ok)?
> 
> We are using the default openssl version available in CentOS 5.8.  
> I could look into that but we are talking hundreds of thousands of  
> servers still using 0.9.8e.

I’m mostly concerned by local changes by your OS vendor, not about  
openssl 0.9.8e by itself. BTW, when you’ve upgraded your openssl  
last time? I.e. did the same openssl package version worked for  
you before, or you’ve upgraded it with nginx as well?

> Personally I’m not comfortable yet moving to CentOS 6.2. I will create  
> an openssl-1.0.1 RPM for CentOS 5.8 and test it on a development server,  
> then move it into production. Still, I don’t recall noticing any SSL  
> errors on previous Nginx version (1.0.12).

As already suggested - you may build nginx with any particular  
openssl version statically, by using --with-openssl= configure  
argument.

Maxim D.

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 26, 2012, 4:42pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/7 "2012-03-26T16:42:17Z")

</div>

No need to - it will be statically compiled. Just drop the “make  
%{?\_smp\_mflags}” part for just “make” - otherwise not going to work with  
OpenSSL 1.0.1 due to a bug. And you will be able to use EC EDH - a lot  
better than just Ephemeral Diffie-Hellman (if you need Perfect Forward  
Secrecy, of course); most of the browsers already support it.

‘–with-openssl=/usr/src/redhat/SOURCES/openssl-1.0.1  
–with-openssl-opt=enable-ec\_nistp\_64\_gcc\_128 --with-cc=/usr/bin/gcc44’  
will do the job for a 64bit build. Just make sure you are using gcc44  
(export CC=/usr/bin/gcc44).

Posted at Nginx Forum:

> **[Re: Socket leaks., pread and \[crit\] SSL\_Write() in 1.0.14](https://forum.nginx.org/read.php?2,224381,224427#msg-224427)**
>
> Hi everyone, I just wanted to let the developers know about some error flags I discovered into Nginx 1.0.14, with debug mode disabled. Socket leaks and pread: 2012/03/24 23:29:52 \[alert\] 10770#0: open socket #46 left in connection 5 2012/03/24...

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 27, 2012, 4:29am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/8 "2012-03-27T04:29:29Z")

</div>

I mention this because the [crit] issues were present in the past with  
Nginx 0.8 and they were solved by Igor. I was hoping a similar fix would  
be provided for latest stable version. Do you recommend me to switch to  
development version? Upgrading openssl is not a viable solution at the  
present time and we are getting a fairly large number of [crit]  
SSL\_write() errors in our logs.

Posted at Nginx Forum:

> **[Re: Socket leaks., pread and \[crit\] SSL\_Write() in 1.0.14](https://forum.nginx.org/read.php?2,224381,224445#msg-224445)**
>
> Hi everyone, I just wanted to let the developers know about some error flags I discovered into Nginx 1.0.14, with debug mode disabled. Socket leaks and pread: 2012/03/24 23:29:52 \[alert\] 10770#0: open socket #46 left in connection 5 2012/03/24...

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 27, 2012, 12:57am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/9 "2012-03-27T00:57:38Z")

</div>

> That’s really strange, changes between 1.0.12 and 1.0.14 are  
> minimal. Could you please re-try with 1.0.12 to see if it works  
> for you without problems?  
> Will do, Maxim. I have to rebuild the RPM again, as I tossed the  
> previous version from yum repository.

> As already suggested - you may build nginx with any particular  
> openssl version statically, by using --with-openssl= configure  
> argument.

Personally, I don’t think is a good idea at all to compile source on a  
production server. I only use RPM’s for the sake of easy upgrades, I  
build my own missing RPM’s for that task. Either ways, the answer is  
clear, in order to have Nginx working properly with SSL in a production  
environment will require to upgrade to CentOS 6 which has openssl 1.0.0  
RPM available. I thought it was a bug that generates those random crit  
issues.

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,224381,224443#msg-224443](http://forum.nginx.org/read.php?2,224381,224443#msg-224443)

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [March 29, 2012, 10:51am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/10 "2012-03-29T10:51:43Z")

</div>

More updates on the SSL issue. I have the following configuration:  
http {

…

```
    ssl_prefer_server_ciphers on;
    ssl_ciphers RC4:HIGH:!aNULL:!MD5;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_session_cache shared:SSL:5m;
    ssl_session_timeout 10m;

```

…  
}

If I disable the ssl\_prefer\_server\_ciphers, the [crit] errors are gone.  
On the other hand, I cannot use anymore the RC4. Any idea what could  
cause this?

Posted at Nginx Forum:

> **[Re: Socket leaks., pread and \[crit\] SSL\_Write() in 1.0.14](https://forum.nginx.org/read.php?2,224381,224593#msg-224593)**
>
> Hi everyone, I just wanted to let the developers know about some error flags I discovered into Nginx 1.0.14, with debug mode disabled. Socket leaks and pread: 2012/03/24 23:29:52 \[alert\] 10770#0: open socket #46 left in connection 5 2012/03/24...

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [April 1, 2012, 12:40am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/11 "2012-04-01T00:40:17Z")

</div>

Hi Maxim,

On 3/26/2012 12:47 PM, Maxim D. wrote:

> As already suggested - you may build nginx with any particular  
> openssl version statically, by using --with-openssl= configure  
> argument.

I followed your advice and built a backlevel RPM for libcripto.so6 and  
libssl.so6 so none of the deps are broken in CentOS 5. Then, I built the  
OpenSSL 1.0.1 RPM’s and rebuilt Nginx against the latest libs:

# yum list openssl\* nginx

Loaded plugins: fastestmirror  
Loading mirror speeds from cached hostfile

- base: [mirrors.manchester.icecolo.com](http://mirrors.manchester.icecolo.com)
- extras: [mirrors.manchester.icecolo.com](http://mirrors.manchester.icecolo.com)
- updates: [mirrors.manchester.icecolo.com](http://mirrors.manchester.icecolo.com)  
Installed Packages  
nginx.x86\_64 1.0.14-1.el5 installed  
openssl.x86\_64 1.0.1-1.el5 installed  
openssl-libs.x86\_64 1.0.1-1.el5 installed  
openssl098e.x86\_64 0.9.8e-1.el5 installed

# nginx -V

nginx version: nginx/1.0.14  
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-52)  
TLS SNI support enabled  
configure arguments: --user=nginx --group=nginx  
–prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx  
–conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx.pid  
–error-log-path=/var/log/nginx/error.log  
–http-log-path=/var/log/nginx/access.log  
–http-client-body-temp-path=/var/lib/nginx/client  
–http-fastcgi-temp-path=/var/lib/nginx/fastcgi  
–http-proxy-temp-path=/var/lib/nginx/proxy  
–http-scgi-temp-path=/var/lib/nginx/scgi  
–http-uwsgi-temp-path=/var/lib/nginx/uwsgi  
–lock-path=/var/lock/subsys/nginx --with-cc-opt=‘-O3 -g -m64  
-mtune=nocona -m128bit-long-double -mmmx -msse3 -mfpmath=sse’  
–with-file-aio --with-http\_addition\_module --with-http\_dav\_module  
–with-http\_degradation\_module --with-http\_flv\_module  
–with-http\_geoip\_module --with-http\_gzip\_static\_module  
–with-http\_image\_filter\_module --with-http\_mp4\_module  
–with-http\_perl\_module --with-http\_random\_index\_module  
–with-http\_realip\_module --with-http\_secure\_link\_module  
–with-http\_ssl\_module --with-http\_stub\_status\_module  
–with-http\_sub\_module --with-http\_xslt\_module --with-mail  
–with-mail\_ssl\_module --with-poll\_module --with-rtsig\_module  
–with-select\_module

http {  
…  
ssl\_prefer\_server\_ciphers on;  
ssl\_ciphers RC4:HIGH:!aNULL:!MD5;  
ssl\_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;  
ssl\_session\_cache shared:SSL:5m;  
ssl\_session\_timeout 10m;  
…

server {  
listen 192.168.1.3:443 ssl default\_server;  
server\_name [www.domain.com](http://www.domain.com);  
access\_log off;  
error\_log /var/log/nginx/localhost.error.log error;  
root /var/www/domain.com;  
index index.php index.html;  
ssl\_certificate domain.com.crt;  
ssl\_certificate\_key domain.com.key;  
…  
}  
}

Even if I eliminated the OpenSSL version issues, I still have random  
[crit] SSL\_write() failures at the same frequency as before. They are  
also accompanied by open socket alerts, of this format:  
[alert] 2380#0: open socket #34 left in connection 12

I’m looking forward to your suggestions.

Regards,

Floren

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [April 2, 2012, 6:20pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/12 "2012-04-02T18:20:55Z")

</div>

Hi Maxim,

On 4/2/2012 7:17 AM, Maxim D. wrote:

> As already suggested, it whould be cool to check if you see the  
> same problem in 1.1.x.
> 
> And to proceed further we need debug log, see here:
> 
> [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/Debugging)
> 
> Note you’ll need to recompile nginx with “–with-debug” configure  
> argument to obtain one.

How safe is to put in production a debug built of Nginx?  
I could easily compile a different built, but I’m concerned of running  
this on a live environment as this is where the errors occur.

Regards,

Floren M.

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [April 2, 2012, 7:07pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/13 "2012-04-02T19:07:28Z")

</div>

Hello!

On Mon, Apr 02, 2012 at 12:15:10PM -0400, Floren M. wrote:

> > Note you’ll need to recompile nginx with “–with-debug” configure  
> > argument to obtain one.
> 
> How safe is to put in production a debug built of Nginx?  
> I could easily compile a different built, but I’m concerned of  
> running this on a live environment as this is where the errors  
> occur.

It’s safe and only adds minimal overhead on logging level checks  
as long as debug log isn’t enabled.

Note though that writing debug logs consume extra resources, and  
it may be noticeable under high load. The debug\_connection  
directive allows to enable debug logging only for selected ip  
addresses to minimize impact.

Maxim D.

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [April 2, 2012, 1:18pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/14 "2012-04-02T13:18:25Z")

</div>

Hello!

On Sat, Mar 31, 2012 at 06:39:37PM -0400, Floren M. wrote:

> libs:  
> openssl098e.x86\_64 0.9.8e-1.el5 installed  
> –http-client-body-temp-path=/var/lib/nginx/client  
> –with-http\_perl\_module --with-http\_random\_index\_module  
> –with-http\_realip\_module --with-http\_secure\_link\_module  
> –with-http\_ssl\_module --with-http\_stub\_status\_module  
> –with-http\_sub\_module --with-http\_xslt\_module --with-mail  
> –with-mail\_ssl\_module --with-poll\_module --with-rtsig\_module  
> –with-select\_module

Please also check if nginx actually uses new openssl library, ldd  
should be helpful here.

> server {  
> }
> 
> Even if I eliminated the OpenSSL version issues, I still have random  
> [crit] SSL\_write() failures at the same frequency as before. They  
> are also accompanied by open socket alerts, of this format:  
> [alert] 2380#0: open socket #34 left in connection 12
> 
> I’m looking forward to your suggestions.

As already suggested, it whould be cool to check if you see the  
same problem in 1.1.x.

And to proceed further we need debug log, see here:

> **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)**
>
> ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com

Note you’ll need to recompile nginx with “–with-debug” configure  
argument to obtain one.

Maxim D.

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [April 3, 2012, 3:09am UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/15 "2012-04-03T03:09:23Z")

</div>

Hi Maxim,

On 4/2/2012 1:06 PM, Maxim D. wrote:

> It’s safe and only adds minimal overhead on logging level checks  
> as long as debug log isn’t enabled.
> 
> Note though that writing debug logs consume extra resources, and  
> it may be noticeable under high load. The debug\_connection  
> directive allows to enable debug logging only for selected ip  
> addresses to minimize impact.

I’ve built a nginx-debug RPM but I’m tempted to try 1.1.18 now. 🙂  
I will use instead 1.0.14, just in case is a nasty bug hidden somewhere  
in Nginx. In this way, we fix both versions. These are the compile  
cflags I used:  
gcc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter  
-Wunused-function -Wunused-variable -Wunused-value -Werror -g -O3 -g  
-m64 -mtune=nocona -m128bit-long-double -mmmx -msse3 -mfpmath=sse

I’m going to leave the error\_log set on error and give it a 256k buffer  
so it should not affect the performance. Since we only deal [crit], I  
don’t think we need to debug anything lower than error.

I’ll add the following settings into http:  
debug\_points abort;  
worker\_rlimit\_core 512M;  
working\_directory /var/lib/nginx/;

Let me know please if I should do anything extra.

Regards,

Floren

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [April 5, 2012, 5:18pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/16 "2012-04-05T17:18:39Z")

</div>

Hi Maxim,

On 4/3/2012 12:32 PM, Maxim D. wrote:

> I’m afraid we aren’t going to fix 1.0.x anyway. The 1.1.x branch  
> will become stable in serveral weeks, and 1.0.x is expected to get  
> only security fixes.

Thanks, I will install a debug version of 1.1.18 into live server.

> For now, please capture debug log. Anything else (including gdb  
> dump of the request in question) isn’t that important, but if you  
> are going to obtain one it might be good idea to recompile nginx  
> without -O3 as it might produce undesired side-effects in gdb  
> output. The -O used by default is good enough.

I’m afraid I will have to keep the -O3 for sake of compile consistency  
with other RPM’s. I will do a debug capture on latest devel version, the  
[crit] errors still occur with 1.1.18 version and OpenSSL 1.0.1.

Regards,

Floren

---

<div class="post-metadata">

**Author:** ![teck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b2d939/32.png) [@teck](https://www.ruby-forum.com/u/teck)\
**Post date:** [April 3, 2012, 6:32pm UTC](https://www.ruby-forum.com/t/socket-leaks-pread-and-ssl-write-in-1-0-14/218248/17 "2012-04-03T18:32:42Z")

</div>

Hello!

On Mon, Apr 02, 2012 at 09:08:47PM -0400, Floren M. wrote:

> I’ve built a nginx-debug RPM but I’m tempted to try 1.1.18 now. 🙂  
> I will use instead 1.0.14, just in case is a nasty bug hidden  
> somewhere in Nginx. In this way, we fix both versions. These are the

I’m afraid we aren’t going to fix 1.0.x anyway. The 1.1.x branch  
will become stable in serveral weeks, and 1.0.x is expected to get  
only security fixes.

> compile cflags I used:  
> gcc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter  
> -Wunused-function -Wunused-variable -Wunused-value -Werror -g -O3 -g  
> -m64 -mtune=nocona -m128bit-long-double -mmmx -msse3 -mfpmath=sse
> 
> I’m going to leave the error\_log set on error and give it a 256k  
> buffer so it should not affect the performance. Since we only deal

The error log doesn’t support buffering.

> [crit], I don’t think we need to debug anything lower than error.

I need complete request debug log to understand what’s going on  
during request processing (and what’s going wrong).

> I’ll add the following settings into http:  
> debug\_points abort;  
> worker\_rlimit\_core 512M;  
> working\_directory /var/lib/nginx/;
> 
> Let me know please if I should do anything extra.

For now, please capture debug log. Anything else (including gdb  
dump of the request in question) isn’t that important, but if you  
are going to obtain one it might be good idea to recompile nginx  
without -O3 as it might produce undesired side-effects in gdb  
output. The -O used by default is good enough.

Maxim D.