Recently seeing a bunch of 400s

[Dave Cheney]

Hmmm,

How regularly does the line show up in your logs ? If its every minute  
or so, then you could try tcpdumping the packets for a minute or so  
then filter through for the IP that was recorded as the problem to  
figure out exactly what they requested.

Cheers

Dave


On 03/12/2008, at 4:49 PM, Neil Sheth wrote:

> Likewise, not seeing anything with too many open files.
>
> On Tue, Dec 2, 2008 at 9:48 PM, Neil Sheth <nsheth at gmail.com> wrote:
>> Sorry - anything in particular I'm looking for to indicate a
>> connections limit?  I've seen that in the past, but received
>> appropriate messages in the nginx error log.  Not seeing anything
>> relevant in the error log this time.
>>
>> On Tue, Dec 2, 2008 at 9:33 PM, Dave Cheney <dave at cheney.net> wrote:
>>>
>>> On Tue, 2 Dec 2008 21:23:47 -0800, Neil Sheth <nsheth at gmail.com>  
>>> wrote:
>>>> Even seeing it in the log from one of Google's ips.  I'll look into
>>>> p0f / tcpdump (not familiar with either).  Anything else suggested?
>>>> Not sure where the request is getting malformed (if that's what's
>>>> going on).
>>>
>>> Check your error.log, lsof your nginx workers, you may be out of  
>>> file
>>> descriptors. Check dmesg and your syslog, your machine may be  
>>> limiting
>>> connections.
>>>
>>> (just some guesses)
>>>
>>> Cheers
>>>
>>> Dave
>>>
>>>
>>>
>>
>