Loads of 408 Request timeout in my logs

[zerillos]

Recently I updated from apache 2.2.17 to apache 2.2.21. as soon as the update finished, I started getting loads of entries like these in my logs:

***.***.***.*** - - [20/Jan/2012:18:26:03 -0500] "-" 408 - "-" "-"

(the only thing left out of the log line is the IP. the rest is as it's in my logs. There's no resource requested, no referer and no user agent.)

for all kinds of IPs, including search engine bots (which excludes a DoS attack).

I tried everything i could think of. I've seen lots of accounts of this across the web (with the same apache upgrade being the event that starts it), but i couldn'd find a resolution.

is it an apache error, or is there something that was not configured properly?

can anyone give me a clue?

thanks!

[lucy24]

Is there any difference between the requests that get a 408 and the ones that don't? You said "no resource requested" and "no user agent" which is certainly not what you'd expect from a legitimate search engine. This in turn implies that the timeout is happening before your server ever finishes processing the request. In English: "We've got incoming..." and then something goes astray.

Can you ever-- or do you routinely-- get a 408 yourself? Timeouts are not easy to recognize for a human user, because your browser's own time limit tends to be shorter than Apache's default.

If you're signed on with GWT or similar, are they showing "crawl errors"?

And, ahem, obvious question: have you spent some time poring over Apache's own discussion lists? They are not easy to navigate, but the information is likely to end up being solid.

Yes, I know. It's a bad sign when you ask a question and in reply you get a bunch more questions.

[zerillos]

I can not reproduce the error on my computer. GWT is not complaining, even though googlebot got the 408 quite a few times.

Yes, i went to apache. There are a few questions similar to mine, but no solution.

The interesting thing is that after the 408, that particular ip stops showing in the logs. Maybe the 408 is issued after the user leaves the page. I found some info saying that when KeepAlive time outs, a 408 is issued. This stopped being logged in apache 1.3, and started being logged again in apache 2.2.18. But how can i be sure this is the case?

[lucy24]

This is your own server, right? So you can set your ErrorLogs to the highest level (Debug) to squeeze the last possible bit of information out of those error messages.

Oh, hey, related question. Are the 408s preceded or followed by requests from the same IP, without the 408 error? That is, do they come in clumps, or do they alternate with non-errors? There's the annoying possibility that there is actually no error at all-- except in the logging process itself.

:: racking brains ::

I've got a nebulous idea that something vaguely analogous was discussed here within the last few months. I will continue racking my brains.

[zerillos]

usually, they are preceded by requests which receive 200. after the 408, the visitor does not send any more requests.

i've seen it give a 408 to a user that was viewing a page from a different site, which had my hotlinked images.

and i've seen IPs get just the 408. no other entry in the logs from them.