400 bad request errors

[pepejose]

pepejose Wrote:
-------------------------------------------------------
> hello again! jeje
> 
> well, I've been watching the logs again and the
> report of Logwatch, now with nginx as reverse
> proxy in front of apache I have in one hour 441
> "NULL 400 Bad Requests" made by  45 ips aprox
> 
> example:
> 
> 17 connections: same ip, same second
> 
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-"
> IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> "-" "-" 
> 
> 	
> These amounts are normal with nginx?
> how can I know the causes of this? 	
> What can I do?
> 
> thanks!! thanks!! thanks!!

I've been looking at the error.log

this is the type of error that causes these entries in the access.log

2009/10/05 18:26:12  31810#0: *29604 client closed prematurely connection while reading client request line, client: IP, server: _

	
in my configuration file I have the following virtualhost:

    server {
	listen *:80;
        server_name  _;  #default
        return 444;
    }

	
then, why a request without host header generating a response 400 (bad request) and not a 444 as in the case if there is the host header but there is no virtualhost defined with same host?

thanks!!!

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,9695,11519#msg-11519