Thanks for the reply.

>> What we're actually seeing is that if a a request takes 300+ seconds, the
>> backend is immediately set as disabled and all further requests are send to
>> the other backend...
>> Are we missing something or is this the correct behaviour for nginx?

>Are you looking at the normally working backend server, or a
>server which was already considered down?

One server X receives a request which takes 300+ seconds to complete . That request gets dropped by nginx due to the read timeout (as expected).
When this happens the server X is disabled and all upcoming request are sent to server Y instead.
My interpretation of the configuration was that the server X would still get requests since it only had 1 failure (and it 3 as configured) during the last 30 seconds?