naxsi icon indicating copy to clipboard operation
naxsi copied to clipboard

Excessive open file handles on rhel7 with naxsi error document

Open Hansh532 opened this issue 2 years ago • 1 comments

We see 10.000s of file handles with nginx 14297 nginx 99r REG 253,5 536237 2883596 /app/nginx/html/nasxierror.html

This is the corresponding naxsi config line DeniedUrl "/naxsierror.html";

naxsi error log: 2022/03/23 14:42:51 [error] 14303#14303: *1116682 NAXSI_FMT: ip=XXXXXXXXXXXX&server=XXXXXXXXX&uri=/XXXXX/XXXX&vers=1.3&total_processed=162192&total_blocked=385&config=block&zone0=BODY&id0=16&var_name0=, client: XXXXX, server: XXXXX, request: "POST /XXXX/XXXX HTTP/1.1", host: "XXXX"

these file handles should close after some time but stay open, thus we need to restart the server periodically. we have this problem since we upgraded to rhel7 from rhel6

known bug? any troubleshooting suggestions?

versions tried: naxsi 0.56 with nginx 1.21.1 and naxsi 1.3 with nginx 1.21.1

Hansh532 avatar Mar 23 '22 13:03 Hansh532

looks like a bug on nginx side, naxsi only redirects to the path you specify.

wargio avatar Mar 23 '22 14:03 wargio