Hello!

On Tue, Dec 07, 2010 at 05:17:03PM -0800, Neil Sheth wrote:

> Hello,
>
> Something I've been seeing for a long time here - I've posted long ago, but
> was never able to find a solution. Looking at our access logs, I see tons
> of lines like (multiple times a minute)
> 123.45.6.789 - - [07/Dec/2010:19:05:51 -0600] "-" 400 0 "-" "-"
>
> I changed my error_log to info, and I see a lot of corresponding entries
> like:
> recv() failed (104: Connection reset by peer) while reading client request
> line
>
> I also set the following, but it doesn't seem to have helped, as I see a lot
> of posts about this issue potentially being caused by large cookies:
> large_client_header_buffers 8 4k;

No, large cookies (as well as other large headers) will cause
messages like "[info] ... client sent too long header line".

Messages like "recv() failed" are likely due to aborted requests
- e.g. users navigate away from your page before all images were
loaded and browser closes unneeded connections. Causes are
basically the same as ones for "accept() failed (53: Software
caused connection abort)" messages[1].

Depending on your particular use case this may be either
completely legitimate (i.e. it just happens often) or indicate
some network problems (i.e. sending request takes long time so it
happens often).

Another possible cause is balancer "pings" which just open/close
connection (and don't send anything). This should be easily seen by
surprisingly familiar client's ip, though turned to be actual
reason of the "400 errors" at least several times here.

[1] http://sysoev.ru/nginx/docs/faq.html (in Russian)

Maxim Dounin

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx