too many 408 error codes in access log

Apache access log is showing too many 408 error codes,nearly 400 per day.

x-x-x-x - - [25/Apr/2012:22:43:06 -0600] "-" 408 0 "-" "-"

there are around 400 of these kind of request from different ip address.

I don't know is this the reason for spawning too many children,sometimes its nearing to 624 children,and that too with just handful of users.How can i figure out the exact cause.we are using php,and mysql(connections-800)

enabled: tcp_tw_reuse

syn_retries :2

syn_ack_retires :3

fin-time_out:30

apache timeout:15

keepalive on

keepalive timout 7

max_spare:40

min_spare:25

requestperchild:4000

MAX_CLIENTS:800

Solution 1:

You set the Timeout to 15? Why?

HTTP 408 is "Request Timeout"

Basically it occurs when the client connect()s, but doesn't send any data before the Timeout.

10.4.9 408 Request Timeout

The client did not produce a request within the time that the server was prepared to wait. The client MAY repeat the request without modifications at any later time.

RFC2616 §10

Change your Timeout back to the default value of 300, and stop trying to prematurely optimise your system.

Solution 2:

As people said above, this is the request timeout.

You could be under a slowloris attack, if it is the case you are happy to see all those 408 in the logs, it means your server is dropping the attackers, and yes check your timeout setting , check if you have mod_reqtimeout.

If your server was not dropping them, it would most probably be down/unreachable.

see also How can I detect Slowloris?