I'm getting hundreds of entries in my access log with invalid requests like this ...|-|15/Dec/2010:08:17:19 +0000|-|-|-|400|0|-|-|-|15/Dec/2010:08:17:19 +0000|-|-|-|400|0|-|-|-|15/Dec/2010:08:17:20 +0000|-|-|-|400|0|-|-|-|15/Dec/2010:08:17:20 +0000|-|-|-|400|0|-|-|-|15/Dec/2010:08:17:20 +0000|-|-|-|400|0|-|-|-|15/Dec/2010:08:17:20 +0000|-|-|-|400|0|-|-

My log file format is


The IP address varies and some of them are valid user IP addresses (not sure about the others). They often appear in the middle of a valid set of requests and then stop.

Anyone got an idea why I'd be getting floods of seemingly invalid requests coming in?

I don't think this can be explained just by saying that it's a hack attempt (though some of it could be) - is there any additional debug setting for NGINX?



  • @Phrongz - you mean the other (newer) question is a duplicate of this older one? :-) Feb 7 '12 at 15:57
  • By date that's true; by helpful answer I believe the other question has the edge. :) (Some requests may be drones, as @incredimike suggests below. In my experience yesterday analyzing my logs, almost all the 400's I'm getting are from Firefox keep-alives—or unused HTTP connections—5 seconds after the last valid request.)
    – Phrogz
    Feb 7 '12 at 16:02

This is part of running a server that's open to anonymous requests from the Internet. It looks like some client is attempting a connection, then immediately dropping it. I expect that it's a drone attempting to see what web server you're running... and to exploit you, if possible. Good thing you're running nginx ;)

  • Unfortunately many of the requests are from known customer ip addresses (can't determine if the others are valid) and appear in the middle of an otherwise valid set of requests. Dec 16 '10 at 9:21

Your problem may be that your Nginx large_client_header_buffers need to be increased per this dicussion.

Alternatively, your problem may be simply web browsers opening an HTTP connection and then closing it without using it, or is using Keep-Alive and reaches the timeout. In this case it's not a problem that the users are ever seeing, but just Nginx reporting an error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.