The timeout specified has expired in Apache status.

[peterk]

Hello,

I just noticed in the Apache status the errors as below.

0-0 26862 0/12/12 _ 0.49 2 255 602 0.0 0.16 0.16 91.233.19.251 h2 domain.com:443 [1/1] The timeout specified has expired.
3-0 26865 0/55/55 _ 0.94 12 276 2613 0.0 0.28 0.28 46.149.208.250 h2 anotherdomain.com:443 [22/22] The timeout specified has expired

I didn't find any errors in the Apache logs - is this normal? Is there anything to worry about?

 

[kodeslogic]

Are you able to access anotherdomain.com?

 

[peterk]

I have changed the names of customer domains in the example, of course.
All the sites work correctly, there are no problems accessing to them.

I just noticed these errors today and would like to find out what is causing them and if this is actually a problem.

 

[cPRex]

I think it's fine if it shows up in the status as long as the site is still working normally. If every request was causing that error, that would indicate an issue, but if it's just one, or even a few, I wouldn't worry about it too much.

You could check the main Apache log with a command like this to see how many their have been in total:

grep "The timeout specified has expired" /etc/apache2/logs/error_log | wc -l

and then run this command to see how far back the Apache log goes, to give you an idea of how often it happens:

head -5 /etc/apache2/logs/error_log

I checked my personal server, which doesn't get much traffic, and I see 5 entries in the last four months.

 

[peterk]

I checked now and it looks like the last errors showed up in the log two days ago.
I'll monitor the apache error log, but everything seems to be fine.

What do you think about it?


[root@alpha ~]# grep "The timeout specified has expired" /etc/apache2/logs/error_log | wc -l
150

[root@alpha ~]# head -5 /etc/apache2/logs/error_log
[Wed Mar 22 07:53:50.862560 2023] [http2:info] [pid 12059:tid 47727928562752] AH03090: mod_http2 (v2.0.11, feats=CHPRIO+SHA256+INVHD+DWINS, nghttp2 1.52.0), initializing...
[Wed Mar 22 07:53:50.863359 2023] [mpm_worker:notice] [pid 12059:tid 47727928562752] AH00292: Apache/2.4.56 (cPanel) OpenSSL/1.1.1t mod_bwlimited/1.4 configured -- resuming normal operations
[Wed Mar 22 07:53:50.863374 2023] [core:notice] [pid 12059:tid 47727928562752] AH00094: Command line: '/usr/sbin/httpd'
[Wed Mar 22 07:53:50.870864 2023] [http2:info] [pid 30122:tid 47727928562752] h2_workers: created with min=25 max=37 idle_ms=600000
[Wed Mar 22 07:53:51.880875 2023] [http2:info] [pid 30185:tid 47727928562752] h2_workers: created with min=25 max=37 idle_ms=600000

 

[cPRex]

So about 4 a day or so, give or take. That doesn't seem like enough to be an attack, and everything is working well, so I personally wouldn't worry.

 

[peterk]

Thank you for your explanation.