# Some requests not getting logged **URL:** \ **Category:** NGINX\ **Created:** [September 18, 2012, 1:39am UTC](https://www.ruby-forum.com/t/some-requests-not-getting-logged/222980 "2012-09-18T01:39:27Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [September 18, 2012, 1:39am UTC](https://www.ruby-forum.com/t/some-requests-not-getting-logged/222980/1 "2012-09-18T01:39:27Z")
Hello, I’ve noticed that some (seemingly random) requests get logged as 400 and 408 codes without 301 or 200 codes showing up in the logs. This seems to occur a lot when redirecting people from http \> https via a 301 redirect, the 301 redirect will in many cases not appear at all in the logs but will instead show the following after some time has passed: - - 24. **.** _._\* - - [17/Sep/2012:19:19:07 -0400] “-” 400 0 “-” “-” “-” “-” I’ve also seen some https requests not show up in the logs at all as 200 codes, but will eventually display 408 codes: TLSv1 ECDHE-RSA-RC4-SHA 213._ **.** _.\*\* - - [17/Sep/2012:18:30:31 -0400] “-” 408 0 “-” “-” “-” “-” I’ve also been able to confirm that all of these requests are successful, so is this something wrong with the logging, or is this normal behavior? To me it seems buggy how someone could make a 301 or 200 code request, and be completely hidden in the access logs other than the eventual 400/408s. Posted at Nginx Forum: > **[Some requests not getting logged](https://forum.nginx.org/read.php?2,230801,230801#msg-230801)** > > Hello, I've noticed that some (seemingly random) requests get logged as 400 and 408 codes without 301 or 200 codes showing up in the logs. This seems to occur a lot when redirecting people from http \> https via a 301 redirect, the 301 redirect... ---
**Author:** ![eiji-gravion](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/13edae/32.png) [@eiji-gravion](https://www.ruby-forum.com/u/eiji-gravion)\ **Post date:** [September 18, 2012, 3:03am UTC](https://www.ruby-forum.com/t/some-requests-not-getting-logged/222980/2 "2012-09-18T03:03:36Z")
I also met this problem with 1gb+ log increasing everyday… – _Yours sincerely,_ _Christopher M._ Ambassador/Contributor of Fedora Project and many others. > **[Magic Transit LaB](http://cicku.me)** > > DDoS Protection for Networks - Cloudflare [http://mirrors.cicku.me](http://mirrors.cicku.me) ---
**Author:** ![eiji-gravion](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/13edae/32.png) [@eiji-gravion](https://www.ruby-forum.com/u/eiji-gravion)\ **Post date:** [September 18, 2012, 8:47am UTC](https://www.ruby-forum.com/t/some-requests-not-getting-logged/222980/3 "2012-09-18T08:47:11Z")
Hello! On Mon, Sep 17, 2012 at 07:38:49PM -0400, eiji-gravion wrote: > be completely hidden in the access logs other than the eventual 400/408s. > Most likely this is a result of a cached response being used by a > browser, while in logs you see only a connection which was open by > the browser but no requests were sent in it. Maxim D. ---
**Author:** ![eiji-gravion](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/13edae/32.png) [@eiji-gravion](https://www.ruby-forum.com/u/eiji-gravion)\ **Post date:** [September 19, 2012, 3:58pm UTC](https://www.ruby-forum.com/t/some-requests-not-getting-logged/222980/4 "2012-09-19T15:58:55Z")
On 18 September 2012 07:46, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > I’ve also seen some https requests not show up in the logs at all as 200 > > codes, but will eventually display 408 codes: > > > > TLSv1 ECDHE-RSA-RC4-SHA 213._ **.** _.\*\* - - [17/Sep/2012:18:30:31 -0400] “-” > > 408 0 “-” “-” “-” “-” > > Most likely this is a result of a cached response being used by a > browser, while in logs you see only a connection which was open by > the browser but no requests were sent in it. I agree. I believe we already covered this here on the list a while ago, didn’t we? I seem to recall it’s caused by UAs optimistically opening (multiple?) connections to origin servers, and then closing them after they go unused. I.e. with no data transferred (i.e. 400/408 depending on protocol). I suspect you see these at HTTP-\>HTTPS redirection as that’s the point at which the UA notices that it’s no longer accessing the [HTTP://site/](HTTP://site/) , and closes the unused/cached/fallow optimistic HTTP connections it had opened in /case/ the user continued browsing over HTTP. ## My 2 cents, Jonathan Jonathan M. Oxford, London, UK > **[Jonathan Matthews :: Words Typed, Great Rates For Cash](https://www.jpluscplusm.com)**