1

We have a debian based reverse proxy server which is under testing for product scanning for a store and all of a sudden it didn't connect and started showing 503 service unavailable. The next day it was all back to normal. I need to figure out what actually caused the problem.

ssl_error_ssl.log

[Mon Aug 29 16:46:41.591170 2022] [proxy:error] [pid 510018:tid 140359615092480 ] (111)Connection refused: AH00957: https: attempt to connect to xxx.xx.xx.xxx: 443 (xxxxxxxxxxxx.com:443) failed

ssl_access_ssl.log

[29/Aug/2022:16:38:23 +0200] "POST /scanless-frontend-service/res t/self-service-store/v1/itemTaken HTTP/1.1" 503 299 "-" "Apache-HttpClient/4.5.6 (Java/1.8.0_281)"

The logs which above are rev proxy logs.

Attaching error log

[Mon Aug 29 08:32:23.582826 2022] [core:notice] [pid 4766 64:tid 140359833754944] AH00094: Command line: '/usr/sbin/apache2'

[Tue Aug 30 00:00:07.852429 2022] [mpm_worker:notice] [pid 476664:tid 1403598337 54944] AH00297: SIGUSR1 received. Doing graceful restart

syslog

Aug 29 16:47:08 itrevproxy02 systemd[1]: apt-daily.service: Succeeded.

Aug 29 16:47:08 itrevproxy02 systemd[1]: Finished Daily apt download activities.

Aug 29 17:17:01 itrevproxy02 CRON[510421]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)

Aug 29 18:17:01 itrevproxy02 CRON[510439]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)

Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): SslConnect: lfodown01-lanner-lion.cloudsink.net:443

Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): ConnectWithP roxy: Unable to get application proxy host from CsConfig: c0000225

Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): SslConnect: Unable to connect to lfodown01-lanner-lion.cloudsink.net:59552 via Application P roxy: c0000225

Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): trying to co nnect to lfodown01-lanner-lion.cloudsink.net:443

Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): Connected di rectly to lfodown01-lanner-lion.cloudsink.net:443

Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): ValidateCert ificate: Certificate verified!

Aug 29 19:13:43 itrevproxy02 falcon-sensor[257649]: CrowdStrike(4): SSLSocket co nnected successfully to lfodown01-lanner-lion.cloudsink.net:443

Aug 29 19:17:01 itrevproxy02 CRON[510456]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)

Aug 29 20:17:01 itrevproxy02 CRON[510473]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly)

Aug 29 21:17:01 itrevproxy02 CRON[510490]: (root) CMD ( cd / && run-parts --re port /etc/cron.hourly) –

Can someone please help me understand what has caused this error?

Improve this question
9
  • 1
    Connection refused: AH00957: https: attempt to connect to xxx.xx.xx.xxx: 443 (xxxxxxxxxxxx.com:443) failed. Your proxy couldn't connect to xxx.xx.xx.xxx:443 - maybe looking in the logs on that server would be a good start? It seems the proxy is doing what it should.
    – garethTheRed
    Aug 30, 2022 at 11:28
  • Hi GarethTheRed ......I posted logs which i found in server....these were repeating so just added once.
    – sameer
    Aug 30, 2022 at 12:49
  • Are they the reverse-proxy logs or the proxied server logs?
    – garethTheRed
    Aug 30, 2022 at 14:39
  • GarethTheRed.....added the logs in the link
    – sameer
    Aug 31, 2022 at 9:29
  • 1
    There's nothing much in those logs around the time of the failure. The only thing we can glean is that apt-daily was running at around the time the server issued the 503 response. Other than the apt download service, we don't know what else was being run. The server seems to be running Apache with MPM. Are you running a PHP application or similar? If so, find out where that logs to and inspect those.
    – garethTheRed
    Aug 31, 2022 at 9:53

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .