Recently seeing a bunch of 400s

Dave Cheney dave at
Wed Dec 3 12:27:40 MSK 2008


How regularly does the line show up in your logs ? If its every minute  
or so, then you could try tcpdumping the packets for a minute or so  
then filter through for the IP that was recorded as the problem to  
figure out exactly what they requested.



On 03/12/2008, at 4:49 PM, Neil Sheth wrote:

> Likewise, not seeing anything with too many open files.
> On Tue, Dec 2, 2008 at 9:48 PM, Neil Sheth <nsheth at> wrote:
>> Sorry - anything in particular I'm looking for to indicate a
>> connections limit?  I've seen that in the past, but received
>> appropriate messages in the nginx error log.  Not seeing anything
>> relevant in the error log this time.
>> On Tue, Dec 2, 2008 at 9:33 PM, Dave Cheney <dave at> wrote:
>>> On Tue, 2 Dec 2008 21:23:47 -0800, Neil Sheth <nsheth at>  
>>> wrote:
>>>> Even seeing it in the log from one of Google's ips.  I'll look into
>>>> p0f / tcpdump (not familiar with either).  Anything else suggested?
>>>> Not sure where the request is getting malformed (if that's what's
>>>> going on).
>>> Check your error.log, lsof your nginx workers, you may be out of  
>>> file
>>> descriptors. Check dmesg and your syslog, your machine may be  
>>> limiting
>>> connections.
>>> (just some guesses)
>>> Cheers
>>> Dave

More information about the nginx mailing list