我的服务器最近崩溃了。我使用 Ruby 版本管理器在一台共享服务器上运行两个 nginx 服务器来处理 gem 依赖关系。在我设置 .rvmrc 来切换应用程序发出的调用后，一切都进行得相当顺利。但每隔几天它就会崩溃一次。
我认为原因可能是我正在提取代码，或者重新启动另一个框。不太确定。我进入日志并发现了这一点，并发现了一个真的真的奇怪的链接作为“引荐来源”。不知道“引荐来源”是什么，而且它肯定与我的网站 www.truejersey.com 无关。我不知道这些日志是什么意思，所以只要简单解释一下就足够了。非常感谢！
2011/03/04 10:11:38 [info] 25504#0: *20008271 client closed prematurely connection, so upstream connection is closed too (104: Connection reset by peer) while sending request to upstream, client: 194.65.234.120, server: true.shadyfront.webfactional.com, request: "GET /pages/aboutjersey/photos/thumbs/nj-gazette.jpg HTTP/1.1", upstream: "http://127.0.0.1:11363/pages/aboutjersey/photos/thumbs/nj-gazette.jpg", host: "www.truejersey.com", referrer: "http://www.portalentretextos.com.br/colunas/recontando-estorias-do-dominio-publico/e-o-demonio-de-nova-jersey-o-decimo-terceiro-filho-de-deborah-leeds,236,4485.html"
2011/03/04 10:22:02 [info] 25503#0: *20018714 client 207.46.204.197 closed keepalive connection (104: Connection reset by peer)
2011/03/04 10:22:40 [info] 25503#0: *20019126 client 207.46.204.197 closed keepalive connection (104: Connection reset by peer)
2011/03/04 10:26:09 [info] 25503#0: *20022733 client 65.52.110.26 closed keepalive connection (104: Connection reset by peer)
2011/03/04 10:38:46 [error] 25503#0: *20034686 connect() failed (111: Connection refused) while connecting to upstream, client: 2.80.170.148, server: true.shadyfront.webfactional.com, request: "GET /pages/aboutjersey/photos/thumbs/nj-gazette.jpg HTTP/1.1", upstream: "http://127.0.0.1:11363/pages/aboutjersey/photos/thumbs/nj-gazette.jpg", host: "www.truejersey.com", referrer: "http://www.portalentretextos.com.br/colunas/recontando-estorias-do-dominio-publico/e-o-demonio-de-nova-jersey-o-decimo-terceiro-filho-de-deborah-leeds,236,4485.html"
2011/03/04 10:39:48 [error] 25503#0: *20035361 connect() failed (111: Connection refused) while connecting to upstream, client: 68.204.64.69, server: true.shadyfront.webfactional.com, request: "GET /pages/aboutjersey/photos/thumbs/tat6.jpg HTTP/1.1", upstream: "http://127.0.0.1:11363/pages/aboutjersey/photos/thumbs/tat6.jpg", host: "www.truejersey.com", referrer: "http://matthewraphaelmelvin.blogspot.com/2011/02/jersey-tattoos.html"
2011/03/04 10:39:48 [error] 25503#0: *20035371 connect() failed (111: Connection refused) while connecting to upstream, client: 68.204.64.69, server: true.shadyfront.webfactional.com, request: "GET /pages/aboutjersey/photos/thumbs/tat8.jpg HTTP/1.1", upstream: "http://127.0.0.1:11363/pages/aboutjersey/photos/thumbs/tat8.jpg", host: "www.truejersey.com", referrer: "http://matthewraphaelmelvin.blogspot.com/2011/02/jersey-tattoos.html"
2011/03/04 10:40:00 [error] 25503#0: *20035641 connect() failed (111: Connection refused) while connecting to upstream, client: 2.80.170.148, server: true.shadyfront.webfactional.com, request: "GET /pages/aboutjersey/photos/thumbs/nj-gazette.jpg HTTP/1.1", upstream: http://127.0.0.1:11363/pages/aboutjersey/photos/thumbs/nj-gazette.jpg", host: "www.truejersey.com", referrer: "http://www.portalentretextos.com.br/colunas/recontando-estorias-do-dominio-publico/e-o-demonio-de-nova-jersey-o-decimo-terceiro-filho-de-deborah-leeds,236,4485.html"
答案1
HTTP 访问日志中充满了奇怪的东西；通常是脚本小子或机器人发送奇怪的用户代理字符串或引用 URL，以查看您的 Web 服务器是否存在已知的缓冲区溢出漏洞。除非您能够始终将这些奇怪的日志条目与系统中的故障事件联系起来，否则它们通常不值得跟进；大多数情况下，真正的应用程序或系统崩溃会伴随着系统日志中有用的（或至少是说明性的）信息。这就是我开始寻找的地方。
答案2
引荐来源是客户端/浏览器主动发送到服务器的 HTTP 标头，因此服务器日志可用于确定人们如何找到您的网站等信息。问题是，由于它是由客户端发送的，因此不可信任。恶意客户端（或脚本小子）可以伪造此信息。