On Tue, February 14, 2017 1:48 pm, Walter Alejandro Iglesias wrote: > Starting from Feb 11 my httpd logs are filled with 408 messages: > > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET / > HTTP/1.1" 200 2535 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/styles.css HTTP/1.1" 200 282 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/img/home-novelas.png HTTP/1.1" 200 1812 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/img/home-comic.png HTTP/1.1" 200 2779 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/img/at.png HTTP/1.1" 200 324 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/img/home-devel.png HTTP/1.1" 200 4111 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/img/home-articles.png HTTP/1.1" 200 5835 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/img/home-about.jpg HTTP/1.1" 200 22211 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET > /en/img/home-social.png HTTP/1.1" 200 2782 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " > 408 0 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " > 408 0 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " > 408 0 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " > 408 0 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " > 408 0 > roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " > 408 0 > > This affects my main site only (I have other several virtual sites > hosted in that machine), the only one using ssl on 443 port. As the > example shows, some of them come right before a same source IP > successful connection. In fact, the hidden ip above is me browsing my > web site from another location. Besides, I didn't notice any delay, the > pages are loaded as fast as before the messages started to appear. > > Increasing the request time out (in /etc/httpd.conf): > > connection request timeout 120 > > seems (not sure) to reduce a bit the number of messages. > > What intrigues me (and the reason I'm mentioning this here) is before > Feb 11th, the date the first appeared, there is none, passed that date > *all* requests generate that message. I follow -current and upgrade > snapshots regularly. Could be some change in the system the cause? >
Yes: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/httpd/server.c.diff?r1=1.106&r2=1.107&f=h I am assuming these are client pre-negotiated connections to speed up the user experience. I guess they were not properly being closed before. Unfortunately the commit message is not helpful here.
