我遇到这个问题，当我启动nginx时，它开始以每秒1个GET请求的速率从端口80上的nginx发送/接收stream量到/ping ，但我无法追查是什么导致它。 任何想法如何追踪什么过程造成这种stream量？
日志示例： /tmp/nginx.error.log
2011/03/31 21:30:33 [error] 6587#0: *7213 connect() to unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock failed (111: Connection refused) while connecting to upstream, client: 10.252.27.111, server: myhost.com, request: "GET /ping HTTP/1.1", upstream: "http://unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock:/ping", host: "newcaprica11" 2011/03/31 21:30:33 [error] 6587#0: *7215 connect() to unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock failed (111: Connection refused) while connecting to upstream, client: 10.204.203.236, server: myhost.com, request: "GET /ping HTTP/1.1", upstream: "http://unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock:/ping", host: "newcaprica11" 2011/03/31 21:30:34 [error] 6587#0: *7217 connect() to unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock failed (111: Connection refused) while connecting to upstream, client: 10.252.27.111, server: myhost.com, request: "GET /ping HTTP/1.1", upstream: "http://unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock:/ping", host: "newcaprica11" 2011/03/31 21:30:34 [error] 6587#0: *7219 connect() to unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock failed (111: Connection refused) while connecting to upstream, client: 10.204.203.236, server: myhost.com, request: "GET /ping HTTP/1.1", upstream: "http://unix:/home/deploy/apps/dashboard/current/tmp/sockets/unicorn.sock:/ping", host: "newcaprica11"
Nginx的访问日志： nginx.vhost.access.log
10.252.27.111 - - [31/Mar/2011:21:33:23 +0000] "GET /ping HTTP/1.1" 502 728 "-" "-" 10.204.203.236 - - [31/Mar/2011:21:33:23 +0000] "GET /ping HTTP/1.1" 502 728 "-" "-" 10.252.27.111 - - [31/Mar/2011:21:33:24 +0000] "GET /ping HTTP/1.1" 502 728 "-" "-" 10.204.203.236 - - [31/Mar/2011:21:33:24 +0000] "GET /ping HTTP/1.1" 502 728 "-" "-" 10.252.27.111 - - [31/Mar/2011:21:33:25 +0000] "GET /ping HTTP/1.1" 502 728 "-" "-"
我用myhost.comreplace了我们的真实主机名，但奇怪的是在error.log中有主机主机：“newcaprica11”
更多细节：
nmap -P0 10.204.203.236 Starting Nmap 5.21 ( http://nmap.org ) at 2011-03-31 21:38 UTC Nmap scan report for ip-10-204-203-236.ec2.internal (10.204.203.236) Host is up (0.00042s latency). Not shown: 994 filtered ports PORT STATE SERVICE 80/tcp open http 6667/tcp closed irc 8001/tcp closed unknown 8080/tcp closed http-proxy 9000/tcp closed cslistener 9090/tcp closed zeus-admin
所以他们在80上运行某种web服务
另外一个telnet显示：
telnet 10.204.203.236 80 Trying 10.204.203.236... Connected to 10.204.203.236. Escape character is '^]'. GET / HTTP/1.0 HTTP/1.1 302 Found Server: Apache/2.2.9 (Debian) Phusion_Passenger/2.2.15 X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.15 X-Runtime: 310 Cache-Control: no-cache Location: http://newcaprica9/neighborhoods Status: 302 Vary: Accept-Encoding Content-Type: text/html; charset=utf-8 Content-Length: 98 Date: Thu, 31 Mar 2011 21:39:16 GMT X-Varnish: 2154834965 Age: 0 Via: 1.1 varnish Connection: close <html><body>You are being <a href="http://newcaprica9/neighborhoods">redirected</a>.</body></html>Connection closed by foreign host.
很显然，它的一些Rails或Rack应用程序运行的东西很糟糕。
从日志文件10.252.27.111 ， 10.204.203.236服务器10.252.27.111和10.204.203.236正在请求/ping资源。 Nginx正在抱怨，因为在Nginx中configuration了/ping ，并连接到本地套接字unicorn.sock并从那里拉取数据来完成请求。 这是从套接字connection refused ，所以是抛出502错误。
在这种情况下，我相信上游是nginx连接的后端，以获得对请求的响应。
我不知道你是否匿名这些IP地址，或者如果他们真的是RFC1918地址。 无论哪种方式，他们是做请求的人。
我认为。