logwatch e-mail outputs somewhere between 3-5 "400 Bad Request" items a day. It is mostly for the same URLs every day, but rarely more than 1 time per URL. The URLs listed are mostly for standard page views on our website (URLs that almost every user will visit).
When grepping the
error.log for the IPs listed in the
access.log as having received the error, the result is always
[error] [client xxx.xxx.xxx.xxx] request failed: error reading the headers, referer: xxx.
My assumption is that these are nothing to worry about, at least when they are this infrequent.
Is the number of errors we are seeing here produced by dropped connections, or something similar? What should I examine to figure it out? Should I just leave it alone?