On Tue, Oct 06, 2009 at 10:19:04AM -0400, pepejose wrote:
> pepejose Wrote:
> -------------------------------------------------------
> > hello again! jeje
> >
> > well, I've been watching the logs again and the
> > report of Logwatch, now with nginx as reverse
> > proxy in front of apache I have in one hour 441
> > "NULL 400 Bad Requests" made by 45 ips aprox
> >
> > example:
> >
> > 17 connections: same ip, same second
> >
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> >
> >
> > These amounts are normal with nginx?
> > how can I know the causes of this?
> > What can I do?
> >
> > thanks!! thanks!! thanks!!
>
> I've been looking at the error.log
>
> this is the type of error that causes these entries in the access.log
>
> 2009/10/05 18:26:12 31810#0: *29604 client closed prematurely connection while reading client request line, client: IP, server: _
>
>
> in my configuration file I have the following virtualhost:
>
> server {
> listen *:80;
> server_name _; #default
> return 444;
> }
>
>
> then, why a request without host header generating a response 400 (bad request) and not a 444 as in the case if there is the host header but there is no virtualhost defined with same host?
Do the following:
---
telnet you.host 80
^D
---
or
---
telnet you.host 80
^]
quit
---
then look in logs.
--
Igor Sysoev
http://sysoev.ru/en/
