NGINX Reverse Proxy : Many html status code 400 responses, why?

Question

We have recently implemented a nginx based reverse proxy.

While, debugging our access logs, we are seeing quite a bit of status code 400 results.

They look something like this:

[07/Sep/2011:05:49:04 -0700] - "400" 0 "-" "-" "-"

We have enabled debug error logging, and they usually correspond to something like this:

2011/09/07 05:09:28 [info] 5937#0: *30904 client closed prematurely connection while reading client request line

We have tried raising a number of the buffers, as mentioned by a few pages we were able to google up.

http://www.ruby-forum.com/topic/173362

or

http://blog.craz8.com/articles/2009/06/17/nginx-400-bad-request-errors-due-to-cookies-and-what-to-do-about-them

To no avail.

Why is this happening?

This is a strandard nginx reverse proxy -> apache backend server.

Worth mentioning, the unique type of content on our site is fairly minimal. We have tested this using many browsers and are not personally receiving any of these 400 results.

Thanks!

Further urls detailing similar entries in their logs:

http://blog.rayfoo.info/2009/10/weird-web-server-access-log-entries

Is the first log your Apache's log and the second the nginx's? — palacsint
– palacsint, Commented Sep 10, 2011 at 18:22
Negative. The first is the nginx access log, the second is the nginx error log set to debug. — anonymous-one
– anonymous-one, Commented Sep 10, 2011 at 19:57
Are you behind an EC2 Elastic Load Balancer? Part of their healthcheck causes these to be recorded frequently in the logs. — Meekohi
– Meekohi, Commented Jul 31, 2013 at 22:53

Nikhil · Accepted Answer · 2012-10-29 04:30:33Z

8

I found this was caused by using Chrome, which apparently opens extra connections occasionally without sending any data.

Here's some more info: http://www.ruby-forum.com/topic/2953545

Now the question is what to do about them - the answer provided there wasn't very satisfying.

edited Oct 29, 2012 at 4:30

Nikhil

16.2k20 gold badges66 silver badges81 bronze badges

answered Apr 20, 2012 at 21:01

Ross117

1,0201 gold badge12 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Jehiah · Accepted Answer · 2011-11-17 14:42:50Z

1

Are you handling SSL connections? Can you add $ssl_cipher $ssl_protocol to your access log format?

answered Nov 17, 2011 at 14:42

Jehiah

2,77922 silver badges18 bronze badges

Comments

palacsint · Accepted Answer · 2011-09-11 20:56:46Z

0

First, it's fairly possible that your clients send request with really big http headers or urls. Maybe an older version of your application set some (probably big) cookies which are unused now and some clients are still trying send them back.

I'd set the header buffers to a really big value and on the application side log the size of the headers/requests and the complete request if they are bigger than usual. Or completely take out the nginx from the chain and log the header/request with the same conditions. If you can, take out the nginx for only those IPs/subnets where the 400 errors came from. I suppose nginx can log the source IP for these 400 errors.

answered Sep 11, 2011 at 20:56

palacsint

29k11 gold badges85 silver badges113 bronze badges

2 Comments

anonymous-one Over a year ago

tried setting the max header size to 2048k. same issue persisted. since this is happening fairly frequently ill try to do a few tcpdump runs... even tho this is on a very active, production server a few 2-3 min runs shouldnt overload the box.

palacsint Over a year ago

Uh, 2097152 bytes should be enough for any http request. tcpdump is good idea. Let me know if you find something.

Collectives™ on Stack Overflow

NGINX Reverse Proxy : Many html status code 400 responses, why?

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related