Relation "502 Bad Gateway"/"can't apply process slot" and restart iptables?

[jvkranenburg]

Dear,

I have a strange issue on a Plesk 12 VPS. Sometimes the sites result in a "502 Bad Gateway (nginx)". This happens 1 or 2 times a day on different times.

In the httpd log I see a record "can't apply process slot" and in nginx log I see "connect() failed (111: Connection refused) while connecting to upstream" but restarting apache and/or nginx will not always result in a working site.

When I restart iptables everything is working fine again.

Can anyone explain me the possible relation of these three regarding this error?
And, is there anyone who has a solution for the issue so this will not happen again?

Kind Regards,
Jerry

If more details are needed please let me know!!

 

[IgorG]

First of all make sure that you have no failcounters for VPS resources with:

# cat /proc/user_beancounters

Maybe you have lack of VPS resources.

 

[jvkranenburg]

Thanks IgorG, for your quick reply!

Resources are not an issue. Our monitoring tools give a highest CPU usage of 40,9% and for memory 39%.
But ran the command you suggested and all failcounters are 0, as shown in attached file.

 

[IgorG]

Try to check solutions from these KB articles:

http://kb.odin.com/en/123735
http://kb.odin.com/en/122103

 

[jvkranenburg]

The first one I already did.
The second not, added the "resolver 127.0.0.1;" to the nginx.conf file.

Regenerate all domains and restarted apache and nginx.

Lets see if this is the solution!

Will keep you updated. Thanks so far!

 

[jvkranenburg]

After 5 days of working without problems today I had the described issue 2 times till now.

proxy_error_log:
2015/07/14 14:38:57 [error] 31724#0: *43582 connect() failed (111: Connection refused) while connecting to upstream, client: xxx.xx.xx.xxx, server: domeinname.nl, request: "GET /gereedschap-klusgereedschap-dhz-klusspullen/speciekuip-bouwemmer-speciekuipen-bouwemmers.html HTTP/1.1", upstream: "http://xxx.xxx.xxx.xxx:7080/gereeds...iekuip-bouwemmer-speciekuipen-bouwemmers.html", host: "www.domainname.com"

2015/07/14 14:38:58 [error] 31724#0: *43585 connect() failed (111: Connection refused) while connecting to upstream, client: xx.xx.xxx.xx, server: domainname.com, request: "GET /b.html HTTP/1.1", upstream: "http://xxx.xxx.xxx.xxx:7080/b.html", host: "www.domainname.com"

2015/07/14 14:38:59 [error] 31724#0: *43587 connect() failed (111: Connection refused) while connecting to upstream, client: xxx.xx.xx.xx, server: domainname.com, request: "GET /stofstop-deur-afsluitfolie-met-rits-2-5-x-1-1.html HTTP/1.1", upstream: "http://xxx.xxx.xxx.xxx:7080/stofstop-deur-afsluitfolie-met-rits-2-5-x-1-1.html", host: "www.mekki.be"

All cases it seems the firewall blocks the call to http://xxx.xxx.xxx.xxx:7080.
That should be the reason it starts working again when I restart iptables.

But how can I find why iptables, sometimes block's this call? And how can I tell iptables to let calls to 7080 through?

Or maybe I'm completely wrong