lighttpd forum lighty > accept failed: Software caused connection abort 53

Posted by Robert (Guest)
on 31.01.2006 00:54
Hi,

I periodically find a bunch of these errors in my log file:

...
2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
connection abort 53
...

I'm running:
    FreeBSD 6.0-RELEASE-p3
    lighttpd-1.4.9
    PHP 5.1.1 (cgi-fcgi)

Some of my changed settings:
    server.event-handler = "freebsd-kqueue"
    server.max-keep-alive-requests = 4
    server.max-keep-alive-idle = 4
    server.max-fds = 8192
    server.stat-cache-engine = "fam"

Any ideas?

Thanks!
Posted by Jan Kneschke
on 31.01.2006 10:03
Robert wrote:
> Hi,
> 
> I periodically find a bunch of these errors in my log file:
> 
> ...
> 2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
> connection abort 53
> ...
> 
> I'm running:
>     FreeBSD 6.0-RELEASE-p3
>     lighttpd-1.4.9
>     PHP 5.1.1 (cgi-fcgi)
> 
> Some of my changed settings:
>     server.event-handler = "freebsd-kqueue"
>     server.max-keep-alive-requests = 4
>     server.max-keep-alive-idle = 4
>     server.max-fds = 8192
>     server.stat-cache-engine = "fam"

Can you check if you run into a FD limit ? 8192 connections in your case 
?

> Any ideas?
> 
> Thanks!
Posted by Robert Locke
on 31.01.2006 17:22
> Can you check if you run into a FD limit ? 8192 connections in your case 
> ?

Hi Jan,

Even during peak hours, "fstat | wc -l" never seems to exceed 1800. 
Also, I don't get any errors in the log relating to a lack of fds. 
"netstat -m" doesn't indicate any problems either.  Here are some 
network settings from sysctl.conf:

kern.ipc.somaxconn=8192
kern.maxfiles=65536
kern.maxfilesperproc=32768

net.inet.tcp.rfc1323=1
net.inet.tcp.delayed_ack=0
net.inet.tcp.sendspace=65535
net.inet.tcp.recvspace=65535
net.inet.tcp.keepidle=300000
net.inet.tcp.keepintvl=30000
net.inet.udp.recvspace=65535
net.inet.udp.maxdgram=57344

net.local.stream.recvspace=65535
net.local.stream.sendspace=65535

In total I received 500+ errors today, many grouped together at the same 
time.  Could this be someone running a port scanner on our box?

Thanks for any help...
Posted by Jan Kneschke
on 01.02.2006 12:43
Robert Locke wrote:
>> Can you check if you run into a FD limit ? 8192 connections in your case 
>> ?
> 
> Hi Jan,
> 
> Even during peak hours, "fstat | wc -l" never seems to exceed 1800. 
> Also, I don't get any errors in the log relating to a lack of fds. 
> "netstat -m" doesn't indicate any problems either.  Here are some 
> network settings from sysctl.conf:
> 
> kern.ipc.somaxconn=8192
> kern.maxfiles=65536
> kern.maxfilesperproc=32768
> 
> net.inet.tcp.rfc1323=1
> net.inet.tcp.delayed_ack=0
> net.inet.tcp.sendspace=65535
> net.inet.tcp.recvspace=65535
> net.inet.tcp.keepidle=300000
> net.inet.tcp.keepintvl=30000
> net.inet.udp.recvspace=65535
> net.inet.udp.maxdgram=57344
> 
> net.local.stream.recvspace=65535
> net.local.stream.sendspace=65535
> 
> In total I received 500+ errors today, many grouped together at the same 
> time.  Could this be someone running a port scanner on our box?

I suspect that this is a protection from kernel land that is jumping in 
here.

Can you check if /var/log/messages has any hits for this ?

> Thanks for any help...
Posted by Robert Locke
on 06.02.2006 13:55
Jan Kneschke wrote:
> Can you check if /var/log/messages has any hits for this ?

Hi Jan,

Sorry for the late reply.  No corresponding hits in /var/log/messages 
whatsoever.

Is anyone else seeing this?

Best,

Rob
Posted by Quip (Guest)
on 08.02.2006 13:32
Robert Locke wrote:
> Jan Kneschke wrote:
>> Can you check if /var/log/messages has any hits for this ?
> 
> Hi Jan,
> 
> Sorry for the late reply.  No corresponding hits in /var/log/messages 
> whatsoever.
> 
> Is anyone else seeing this?
> 
> Best,
> 
> Rob

I see same problems in my error.log on FreeBSD 6.0-STABLE #1: Fri Nov 11
15:33:07 CET 2005

with lighttpd-1.4.9 compiled from ports

2006-02-08 13:20:32: (server.c.725) WARNING: unknown config-key:
accesslog.filename (ignored)
2006-02-08 13:20:32: (log.c.75) server started
2006-02-08 13:20:33: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:20:43: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:20:53: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:21:03: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:21:13: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:21:23: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:21:33: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:21:43: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:21:53: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:22:03: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:22:13: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:22:23: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:22:33: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:22:43: (connections.c.1236) accept failed: Software caused
connection abort 53
2006-02-08 13:22:53: (connections.c.1236) accept failed: Software caused
connection abort 53

Lighttpd are using only this modules:
"mod_access",
"mod_status",
"mod_proxy",

other settings:

server.event-handler = "freebsd-kqueue" # needed on OS X
server.max-keep-alive-requests = 64
server.max-keep-alive-idle = 5
server.max-read-idle = 60
server.max-write-idle = 180


output of server-status:

Uptime	9 min 44 s
Started at	2006-02-08 13:20:32
absolute (since start)
Requests	1 kreq
Traffic	35.84 Mbyte
average (since start)
Requests	3 req/s
Traffic	62.85 kbyte/s
average (5s sliding average)
Requests	6 req/s
Traffic	97.11 kbyte/s

about 37 connections
Posted by Manuel (Guest)
on 01.03.2006 15:24
Hello,

I run into the same performance issues and hundred of errors in my log 
file (FreeBSD 5 system):

2006-03-01 09:16:15: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-03-01 09:16:18: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-03-01 09:16:22: (connections.c.1236) accept failed: Software caused 
connection abort 53
2006-03-01 09:16:23: (connections.c.1236) accept failed: Software caused 
connection abort 53

Did someone find a solution to this or hint why this is happening?

lighttpd stats:
328 connections
Requests	161 req/s

"mod_rewrite",
"mod_redirect",
"mod_alias",
"mod_access",
"mod_trigger_b4_dl", (memcache)
"mod_auth",
"mod_status",
"mod_setenv",
"mod_compress",
"mod_accesslog"

server.max-fds = 8192
server.max-keep-alive-requests = 0
server.max-keep-alive-idle = 0
server.max-read-idle = 15
server.max-write-idle = 360
server.stat-cache-engine = "fam"

Any help is appreciated!
Posted by ss kk
on 29.03.2006 22:39
just to add to the threat.  i have noticed the same messages in my error 
log with light compiled from ports on FREEBSD 6.0.
Posted by 2ge (Guest)
on 10.09.2006 09:27
Steve Ka wrote:
> just to add to the threat.  i have noticed the same messages in my error 
> log with light compiled from ports on FREEBSD 6.0.

same problem here.
Posted by Guest (Guest)
on 15.09.2006 13:42
Robert wrote:

> 2006-01-30 21:59:05: (connections.c.1236) accept failed: Software caused 
> connection abort 53

Same problem here either. What's more, server yields 'Internal server 
error' after that.

Regards,
Artur
Posted by Daniel Johansson
on 02.10.2006 20:37
Hello, I'm having the exact same error in my log. Running FreeBSD 6.1 
amd64 with lighttpd-1.4.11 installed from ports.

2006-10-02 21:30:22: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 21:39:17: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 21:43:01: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 21:44:57: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 21:45:13: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 21:46:10: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 22:03:15: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 22:13:27: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 22:13:48: (connections.c.1238) accept failed: Software caused 
connection abort 53
2006-10-02 22:20:41: (connections.c.1238) accept failed: Software caused 
connection abort 53

A lot of those messages. Any solution to this yet? The server is 
handleing about 10-20 req/s.