We have a debian based reverse proxy server which is under testing for product scanning for a store and all of a sudden it didn't connect and started showing 503 service unavailable. The next day it was all back to normal. I need to figure out what actually caused the problem.
ssl_error_ssl.log
[Mon Aug 29 16:46:41.591170 2022] [proxy:error] [pid 510018:tid 140359615092480 ] (111)Connection refused: AH00957: https: attempt to connect to xxx.xx.xx.xxx: 443 (xxxxxxxxxxxx.com:443) failed
ssl_access_ssl.log
[29/Aug/2022:16:38:23 +0200] "POST /scanless-frontend-service/res t/self-service-store/v1/itemTaken HTTP/1.1" 503 299 "-" "Apache-HttpClient/4.5.6 (Java/1.8.0_281)"
The logs which above are rev proxy logs.
Attaching error log
[Mon Aug 29 08:32:23.582826 2022] [core:notice] [pid 4766 64:tid 140359833754944] AH00094: Command line: '/usr/sbin/apache2'
[Tue Aug 30 00:00:07.852429 2022] [mpm_worker:notice] [pid 476664:tid 1403598337 54944] AH00297: SIGUSR1 received. Doing graceful restart
syslog
Aug 29 16:47:08 itrevproxy02 systemd[1]: apt-daily.service: Succeeded.
Aug 29 16:47:08 itrevproxy02 systemd[1]: Finished Daily apt download activities.
Aug 29 17:17:01 itrevproxy02 CRON[510421]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)
Aug 29 18:17:01 itrevproxy02 CRON[510439]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)
Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): SslConnect: lfodown01-lanner-lion.cloudsink.net:443
Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): ConnectWithP roxy: Unable to get application proxy host from CsConfig: c0000225
Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): SslConnect: Unable to connect to lfodown01-lanner-lion.cloudsink.net:59552 via Application P roxy: c0000225
Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): trying to co nnect to lfodown01-lanner-lion.cloudsink.net:443
Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): Connected di rectly to lfodown01-lanner-lion.cloudsink.net:443
Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): ValidateCert ificate: Certificate verified!
Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): SSLSocket co nnected successfully to lfodown01-lanner-lion.cloudsink.net:443
Aug 29 19:17:01 itrevproxy02 CRON[510456]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)
Aug 29 20:17:01 itrevproxy02 CRON[510473]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)
Aug 29 21:17:01 itrevproxy02 CRON[510490]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly) –
Can someone please help me understand what has caused this error?
Connection refused: AH00957: https: attempt to connect to xxx.xx.xx.xxx: 443 (xxxxxxxxxxxx.com:443) failed
. Your proxy couldn't connect to xxx.xx.xx.xxx:443 - maybe looking in the logs on that server would be a good start? It seems the proxy is doing what it should.