Starting from Feb 11 my httpd logs are filled with 408 messages: roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET / HTTP/1.1" 200 2535 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/styles.css HTTP/1.1" 200 282 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/img/home-novelas.png HTTP/1.1" 200 1812 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/img/home-comic.png HTTP/1.1" 200 2779 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/img/at.png HTTP/1.1" 200 324 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/img/home-devel.png HTTP/1.1" 200 4111 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/img/home-articles.png HTTP/1.1" 200 5835 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/img/home-about.jpg HTTP/1.1" 200 22211 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:48:32 +0100] "GET /en/img/home-social.png HTTP/1.1" 200 2782 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " 408 0 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " 408 0 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " 408 0 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " 408 0 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " 408 0 roquesor.com 79.xxx.150.xx4 - - [14/Feb/2017:15:49:32 +0100] "<UNKNOWN> " 408 0
This affects my main site only (I have other several virtual sites hosted in that machine), the only one using ssl on 443 port. As the example shows, some of them come right before a same source IP successful connection. In fact, the hidden ip above is me browsing my web site from another location. Besides, I didn't notice any delay, the pages are loaded as fast as before the messages started to appear. Increasing the request time out (in /etc/httpd.conf): connection request timeout 120 seems (not sure) to reduce a bit the number of messages. What intrigues me (and the reason I'm mentioning this here) is before Feb 11th, the date the first appeared, there is none, passed that date *all* requests generate that message. I follow -current and upgrade snapshots regularly. Could be some change in the system the cause?
