18 messages in ru.sysoev.nginxRe: Recently seeing a bunch of 400s
FromSent OnAttachments
Neil ShethDec 2, 2008 8:24 pm 
Dave CheneyDec 2, 2008 8:40 pm 
Neil ShethDec 2, 2008 8:48 pm 
Dave CheneyDec 2, 2008 9:21 pm 
Neil ShethDec 2, 2008 9:23 pm 
Neil ShethDec 2, 2008 9:30 pm 
Dave CheneyDec 2, 2008 9:33 pm 
Neil ShethDec 2, 2008 9:37 pm 
Neil ShethDec 2, 2008 9:48 pm 
Neil ShethDec 2, 2008 9:48 pm 
Dave CheneyDec 3, 2008 1:27 am 
Arvind JayaprakashDec 3, 2008 9:17 am 
Neil ShethDec 11, 2008 3:31 pm 
Dave CheneyDec 11, 2008 7:17 pm 
Neil ShethDec 15, 2008 6:05 pm 
Dave CheneyDec 15, 2008 10:55 pm 
Igor SysoevDec 16, 2008 12:30 am 
Dave CheneyDec 16, 2008 12:56 am 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: Recently seeing a bunch of 400sActions...
From:Dave Cheney (da@cheney.net)
Date:Dec 3, 2008 1:27:17 am
List:ru.sysoev.nginx

Hmmm,

How regularly does the line show up in your logs ? If its every minute or so, then you could try tcpdumping the packets for a minute or so then filter through for the IP that was recorded as the problem to figure out exactly what they requested.

Cheers

Dave

On 03/12/2008, at 4:49 PM, Neil Sheth wrote:

Likewise, not seeing anything with too many open files.

Sorry - anything in particular I'm looking for to indicate a connections limit? I've seen that in the past, but received appropriate messages in the nginx error log. Not seeing anything relevant in the error log this time.

On Tue, Dec 2, 2008 at 9:33 PM, Dave Cheney <da@cheney.net> wrote:

On Tue, 2 Dec 2008 21:23:47 -0800, Neil Sheth <nsh@gmail.com> wrote:

Even seeing it in the log from one of Google's ips. I'll look into p0f / tcpdump (not familiar with either). Anything else suggested? Not sure where the request is getting malformed (if that's what's going on).

Check your error.log, lsof your nginx workers, you may be out of file descriptors. Check dmesg and your syslog, your machine may be limiting connections.

(just some guesses)

Cheers