7

Apache access log is showing too many 408 error codes,nearly 400 per day.

x-x-x-x - - [25/Apr/2012:22:43:06 -0600] "-" 408 0 "-" "-"

there are around 400 of these kind of request from different ip address.

I don't know is this the reason for spawning too many children,sometimes its nearing to 624 children,and that too with just handful of users.How can i figure out the exact cause.we are using php,and mysql(connections-800)

enabled: tcp_tw_reuse

syn_retries :2

syn_ack_retires :3

fin-time_out:30

apache timeout:15

keepalive on

keepalive timout 7

max_spare:40

min_spare:25

requestperchild:4000

MAX_CLIENTS:800

Improve this question
1
  • 1
    It's confused nonsense; half of those "settings" above don't even exist, or are misnamed. Your Timeout directive should be left at the default of 300, unless you know better.
    – adaptr
    Apr 26, 2012 at 7:24

3 Answers 3

Reset to default
3

You set the Timeout to 15? Why?

HTTP 408 is "Request Timeout"

Basically it occurs when the client connect()s, but doesn't send any data before the Timeout.

10.4.9 408 Request Timeout

The client did not produce a request within the time that the server was prepared to wait. The client MAY repeat the request without modifications at any later time.

RFC2616 §10

Change your Timeout back to the default value of 300, and stop trying to prematurely optimise your system.

Improve this answer
4
  • 1
    As you can see in the access.log it is requesting for "-" 408 0 "-" "-" which i think it is invalid,as it is not requesting for any file. Will changing timeout to 300 will make any change to these kind of request,as you can see it is not a valid request.
    – ananthan
    Apr 26, 2012 at 7:36
  • 1
    Because the connection is closing before the request can be sent. What part of Timeout do you not understand?
    – Tom O'Connor
    Apr 26, 2012 at 8:07
  • 1
    @ Tom O'Connor x-x-x-x - - [25/Apr/2012:22:43:06 -0600] "-" 408 0 "-" "-" this is he request coming.From this what i am understanding is ip is requesting for "-" which gives 408 and also the platform and browser is showing "-" "-".Is int so...
    – ananthan
    Apr 26, 2012 at 9:07
  • 1
    Timeout may not be the only setting affecting this. If mod_reqtimeout is in use then a RequestReadTimeout setting may be taking priority.
    – simpleigh
    Sep 16, 2014 at 8:26
2

As people said above, this is the request timeout.

You could be under a slowloris attack, if it is the case you are happy to see all those 408 in the logs, it means your server is dropping the attackers, and yes check your timeout setting , check if you have mod_reqtimeout.

If your server was not dropping them, it would most probably be down/unreachable.

see also How can I detect Slowloris?

Improve this answer
-3

Check IPs and Date-time for all 408 status in logs, check consecutive requests from same ip and check their request time if time difference is low then congratulations you have mod_security enable and configured properly. for more info check this(https://www.modsecurity.org/) out on mod_security.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .