39

We have an application server that sometimes hangs. We suspect it is due to a bad request from a client.

Can nginx log the complete request/response (like fiddler captures) to files, so we can see the requests that were sent before the hang?

(We probably need to avoid pcap and that approach and do it all in nginx)

If nginx is not the right tool for this, what (other than a network analyzer) might be?

  • mitmproxy in reverse proxy mode should do what you are looking for. – Vivek Thomas Oct 14 '14 at 5:55
  • @VivekThomas this is an nginx question.... we are already using nginx and are not going to change. – samsmith Dec 30 '14 at 15:59
  • 3
    @samsmith Old question, but maybe this helps someone else: you don't have to give up nginx. Depending on the circumstances, you can just re-route nginx to another port temporarily, to allow mitmproxy to intercept the traffic and support the debugging. Then, once complete, you can just re-route nginx to the original port and shutdown mitmproxy. – Per Lundberg Nov 27 '17 at 13:03
  • 1
    You can use modsecurity module, which can log full requests/responses, see nginx.com/blog/modsecurity-logging-and-debugging – Willem Oct 16 '18 at 12:54
39

To get the request body sent by visitors, use client_body_in_file_only on; and log the "temporary" file it's written to in the logs by appending var $request_body_file to the log format. "Temporary" files will be located in client_temp directory by default.

You can log request headers $http_<header> too and sent headers with $sent_http_<header>.

If you have request body and headers you should be able to replay it and get the response your visitor had.

Also something like gor should highly be considered so you could replay the traffic on an other environment where you could let nginx write these temporary files without causing IO issues in production (nginx won't purge them with on value that's why It's not that "temporary" in this case).

  • Xavier, Thanks! Works! Now that I have the files, how do I replay them? – samsmith Oct 15 '14 at 2:37
  • 1
    @jwadsack Read the answer carefully. – Xavier Lucas Jul 28 '15 at 9:58
  • 3
    @XavierLucas I thought you were providing two different approaches. I didn't realize you were saying both client_body_in_file_only and $http_<header> would be needed. I get that now. – jwadsack Jul 28 '15 at 17:31
  • 4
    Could you please share a more precise code? – Velkan May 9 '17 at 13:40
  • 2
    Surely $http<header> is only useful if you know all the header names in advance – Ed Randall Feb 2 '18 at 22:37
16

mitmproxy seems to be the right tool to do what you are asking.

mitmproxy is an interactive, SSL-capable man-in-the-middle proxy for HTTP with a console interface.

mitmdump is the command-line version of mitmproxy. Think tcpdump for HTTP.

Features

  • Intercept HTTP requests and responses and modify them on the fly.
  • Save complete HTTP conversations for later replay and analysis.
  • Replay the client-side of an HTTP conversations. Replay HTTP responses of a previously recorded server.
  • Reverse proxy mode to forward traffic to a specified server.
  • Transparent proxy mode on OSX and Linux.
  • Make scripted changes to HTTP traffic using Python.
  • SSL certificates for interception are generated on the fly.

The reverse proxy mode would let you capture the request and response just like Fiddler does.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.