Forum Discussion

asieber_102433's avatar
asieber_102433
Icon for Nimbostratus rankNimbostratus
Jan 29, 2009

log connections, that exceed maximum header size

Hi,

 

 

from time to time we experience some memory issues on our apache webservers.

 

The apache processes use more and more memory (4 times more than usual).

 

 

Everytime this happens, we can see the message "011f0005:3: HTTP header (33304) exceeded maximum allowed size of 32768". I know that this is only a "informal" message. But now I want to know what client and what request caused this log entry, because we want to identify the cause for the memory usage on the webservers.

 

I didn´t find a irule parameter that I can use to log the requests that exceed that maximum http header size.

 

 

Has anyone an idea how to log those requests ?

 

 

kind regards,

 

Alex

 

 

application delivery
dev
devops
iRules

11 Replies

Sort By
Show More
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 18, 2012
    And one more update which logs long URIs, headers or the full request if the full request headers are over X bytes. 

    
when HTTP_REQUEST {

 Check the total HTTP headers size
if {[string length [HTTP::request]] > 10000 }{

 Check if the URI is very long
if {[string length [HTTP::uri]] > 1000}{

log local0. "Uri is long. Length [string length [HTTP::uri]], URI: [HTTP::uri]"

 Exit this event from this iRule
return
}

 Loop through the headers by name
foreach header {[HTTP::header names]} { 

 Check for a long header value
if {[string length [HTTP::header value $header]] > 1000 } { 
log local0. "Header is long. Header Name: $header,\
Length: [string length [HTTP::header value $header]], Value: [HTTP::header value $header]" 
 Exit this event from this iRule
return
}
}

 If we are still here the request was large, but not the URI or any single header.
 Log the first 1k bytes of the full request
log local0. "Request is long: [HTTP::request]"
}
}

    Aaron