What causes a 400 Bad Request error for null ("") and why would our nginx logs have so many?

Daily logs from Logwatch regularly report 400 Bad Request, null: 1744 Time(s) from our nginx logs.

The log entries look like:

123.123.123.123 - - [25/Jan/2011:14:44:19 -0500] "-" 400 173 "-" "-"

Can anyone explain how these are generated and why there are so many? It doesn't appear to be hurting anything, but we've had up to 8000 appear in a day. We host a medium size rails application running on unicorn and nginx.

There is some discussion in the nginx forum, but I haven't found a real solution that decreases the number for 400 Bad Reqeusts logged.

This often happens when a browser is using Keep-Alive and reaches the keep alive timeout. It's quite normal.

If you see 400 errors with a URI / path / method such as GET or POST, etc, then you have a legitimate problem with a user making a bad request. But those should be rare.