# Still 400 response code, but so weird this time **URL:** \ **Category:** NGINX\ **Created:** [August 1, 2013, 9:10am UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038 "2013-08-01T09:10:59Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\ **Post date:** [August 1, 2013, 9:10am UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038/1 "2013-08-01T09:10:59Z")
In access\_log file, huge numbers of log entries like this: 115.85.238.34 1764839163 - 0.242 [01/Aug/2013:11:02:01 +0800] “[foo.bar.com](http://foo.bar.com)” “-” 400 0 “-” “-” “-” log\_format defined in http conf block: ‘$remote\_addr $connection $remote\_user $request\_time [$time\_local] “$hostname” “$request” $status $body\_bytes\_sent “$http\_referer” “$http\_cookie” “$http\_user\_agent”’ Points I realized: 1. Cannot catch $request, which is full original request line according to Nginx documentation. So can it tell at which phrase the connection was dropped? 2. $body\_bytes\_sent is zero. So no HTTP response body was generated. 3. $http\_refer, $http\_cookie and $http\_user\_agent cannot be caught. So does this indicate any issue? p.s. this might be caused by HTTPS/SSL connections from mobile client, but I’m not sure. Could anyone give any words? Thank you in advance! Posted at Nginx Forum: > **[still 400 response code, but so weird this time](https://forum.nginx.org/read.php?2,241435,241435#msg-241435)** > > In access\_log file, huge numbers of log entries like this: 115.85.238.34 1764839163 - 0.242 \[01/Aug/2013:11:02:01 +0800\] "foo.bar.com" "-" 400 0 "-" "-" "-" log\_format defined in http conf block: ' ---
**Author:** ![microwish](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@microwish](https://www.ruby-forum.com/u/microwish)\ **Post date:** [August 1, 2013, 9:29am UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038/2 "2013-08-01T09:29:06Z")
addtions: no corresponding logs in error\_log. Nginx version: 1.2.4 OpenSSL version: OpenSSL 1.0.1e Posted at Nginx Forum: > **[Re: still 400 response code, but so weird this time](https://forum.nginx.org/read.php?2,241435,241439#msg-241439)** > > In access\_log file, huge numbers of log entries like this: 115.85.238.34 1764839163 - 0.242 \[01/Aug/2013:11:02:01 +0800\] "foo.bar.com" "-" 400 0 "-" "-" "-" log\_format defined in http conf block: ' ---
**Author:** ![microwish](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@microwish](https://www.ruby-forum.com/u/microwish)\ **Post date:** [August 1, 2013, 9:37am UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038/3 "2013-08-01T09:37:52Z")
more additions: some SSL related config in Nginx config file ``` ssl_protocols SSLv3 TLSv1; ssl_ciphers RC4:AES128-SHA:3DES:!EXP:!aNULL:!kEDH:!ECDH; ``` Posted at Nginx Forum: > **[Re: still 400 response code, but so weird this time](https://forum.nginx.org/read.php?2,241435,241441#msg-241441)** > > In access\_log file, huge numbers of log entries like this: 115.85.238.34 1764839163 - 0.242 \[01/Aug/2013:11:02:01 +0800\] "foo.bar.com" "-" 400 0 "-" "-" "-" log\_format defined in http conf block: ' ---
**Author:** ![microwish](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@microwish](https://www.ruby-forum.com/u/microwish)\ **Post date:** [August 1, 2013, 11:38am UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038/4 "2013-08-01T11:38:14Z")
Hello! On Thu, Aug 01, 2013 at 03:10:30AM -0400, microwish wrote: > “$http\_cookie” “$http\_user\_agent”’ > > p.s. this might be caused by HTTPS/SSL connections from mobile client, but > I’m not sure. Such lines in access log are caused by opening and closing a connection without sending any data in it. Usually this happens due to browser optimizations (e.g., Chrome opens an additional connection “just in case”), but might appear due to various other reasons as well (e.g. if browser rejects your SSL cert). As of nginx 1.3.15+ such connections are no longer logged to access log, see [http://nginx.org/en/CHANGES](http://nginx.org/en/CHANGES). – Maxim D. > **[nginx: donation](http://nginx.org/en/donation.html)** ---
**Author:** ![microwish](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@microwish](https://www.ruby-forum.com/u/microwish)\ **Post date:** [August 1, 2013, 2:02pm UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038/5 "2013-08-01T14:02:35Z")
Hello! On Thu, Aug 01, 2013 at 06:13:00AM -0400, microwish wrote: > Thanks, Maxim. > > By “Such lines in access log are caused by opening and closing a connection > without sending any data in it”, you are meaning that a client opens a > connection and then closes the connection actively without sending any data, > or that a Nginx worker process accepts a connection and then closes it > actively without sending any data to the client? A client opens a connection, and then closes the connection. > In any case, is the TCP handshake completed? Yes. > I guess that SSL handshakes are already in process, because CPU resource is > consumed much. > > Just as you said, if the browser rejected my SSL cert, what could I do to > solve this issue? First of all, you should check if it’s the case. If it is, you should investigate further why the browser rejects the cert - there are plenty of possible reasons. – Maxim D. > **[nginx: donation](http://nginx.org/en/donation.html)** ---
**Author:** ![microwish](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@microwish](https://www.ruby-forum.com/u/microwish)\ **Post date:** [August 5, 2013, 12:14pm UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038/6 "2013-08-05T12:14:52Z")
Hi Maxim, Now I’m sure that the 400-related logs in access log file are caused by bad SSL connections, which either finish SSH handshakes and then sending no data, or don’t finish SSH handshake at at. I’ll be diving into it for more insights. Thank you. ## Maxim D. Wrote: > [nginx: donation](http://nginx.org/en/donation.html) > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,241435,241584#msg-241584](http://forum.nginx.org/read.php?2,241435,241584#msg-241584) ---
**Author:** ![microwish](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@microwish](https://www.ruby-forum.com/u/microwish)\ **Post date:** [August 1, 2013, 12:13pm UTC](https://www.ruby-forum.com/t/still-400-response-code-but-so-weird-this-time/236038/7 "2013-08-01T12:13:18Z")
Thanks, Maxim. By “Such lines in access log are caused by opening and closing a connection without sending any data in it”, you are meaning that a client opens a connection and then closes the connection actively without sending any data, or that a Nginx worker process accepts a connection and then closes it actively without sending any data to the client? In any case, is the TCP handshake completed? I guess that SSL handshakes are already in process, because CPU resource is consumed much. Just as you said, if the browser rejected my SSL cert, what could I do to solve this issue? Thanks again. Posted at Nginx Forum: > **[Re: still 400 response code, but so weird this time](https://forum.nginx.org/read.php?2,241435,241456#msg-241456)** > > In access\_log file, huge numbers of log entries like this: 115.85.238.34 1764839163 - 0.242 \[01/Aug/2013:11:02:01 +0800\] "foo.bar.com" "-" 400 0 "-" "-" "-" log\_format defined in http conf block: '