Hi Jakov,
On Tue, May 27, 2014 at 07:40:31PM +0200, Jakov Sosic wrote:
> Hi guys,
>
>
> I can see a lot of errors like this in my haproxy log:
>
> May 26 20:57:40 localhost haproxy[9762]: <source_ip>:53644
> [26/May/2014:20:57:40.611] main backend/server03 12/0/-1/-1/12 503 212 -
> - CCVN 148/105/16/6/0 0/0 {www.example.org|Mozilla/5.0 (Windows NT 6.2;
> WOW64) Appl|http://www.example.com/some/link/to/content/} {|} "POST
> /cs/compare/check HTTP/1.1"
What is happening here is simple : the client disconnected before the
connection to the server managed to complete ("CC" flags), and you're
running with "option abortonclose" which allows haproxy to kill a pending
connection to the server.
Given how short the request lasted, I guess that it's a script that sent
this connection. It's basically sending the request and closing the output
channel immediately, waiting for the response. You can get this behaviour
using printf "$request" | nc $site 80. It's very likely a bot sucking your
site, as browsers never ever do that.
Using halog to sort them by IP will probably reveal that most of them
come from a few IP addresses. For this you can run "halog -hs 503 -ic < log".
Regards,
Willy
