400 errors

[Maxim Dounin]

Hello!

On Tue, Dec 07, 2010 at 05:17:03PM -0800, Neil Sheth wrote:

> Hello,
> 
> Something I've been seeing for a long time here - I've posted long ago, but
> was never able to find a solution.  Looking at our access logs, I see tons
> of lines like (multiple times a minute)
> 123.45.6.789 - - [07/Dec/2010:19:05:51 -0600] "-" 400 0 "-" "-"
> 
> I changed my error_log to info, and I see a lot of corresponding entries
> like:
> recv() failed (104: Connection reset by peer) while reading client request
> line
> 
> I also set the following, but it doesn't seem to have helped, as I see a lot
> of posts about this issue potentially being caused by large cookies:
> large_client_header_buffers 8 4k;

No, large cookies (as well as other large headers) will cause 
messages like "[info] ... client sent too long header line".

Messages like "recv() failed" are likely due to aborted requests 
- e.g. users navigate away from your page before all images were 
loaded and browser closes unneeded connections.  Causes are 
basically the same as ones for "accept() failed (53: Software 
caused connection abort)" messages[1].

Depending on your particular use case this may be either 
completely legitimate (i.e. it just happens often) or indicate 
some network problems (i.e. sending request takes long time so it 
happens often).

Another possible cause is balancer "pings" which just open/close 
connection (and don't send anything).  This should be easily seen by 
surprisingly familiar client's ip, though turned to be actual 
reason of the "400 errors" at least several times here.

[1] http://sysoev.ru/nginx/docs/faq.html (in Russian)

Maxim Dounin