The solution to the 502-Bad Gateway problem of nginx reverse proxy

502 bad gateway appears when using nginx reverse proxy localhost:80 domain name to server localhost:8080 port service

Cause analysis:

1. View port 8080 service startup

two。 View the error log: error.log. Take centos7.x as an example, and change the configuration path to: web.dev.xxx.access.ssl.log:

Xxx-[22/Oct/2019:10:24:04 + 0800] "GET / test HTTP/1.1" 502 3693 "-"curl/7.29.0"-"

There is no related error, indicating that there is no error in the nginx reverse proxy configuration, which may be due to an exception in the tomcat service.

3. View SELinux log / var/log/audit/audit.log

Nginx forwarding port 8080 was found to be rejected

SELinux defaults to logging in / var/log/audit/audit.log through the Linux audit system auditd, which is enabled by default; if the auditd resident program is not running, the information will be written into / var/log/messages.

Type=AVC msg=audit (1571711734.564 name_connect 78781): avc: denied {name_connect} for pid=22418 comm= "nginx" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket

4. Use the following directives to view the selinux configuration:

# getsebool httpd_can_network_connect

# httpd_can_network_connect-- > off

The SELinux configuration closes the httpd network connection, so it is natural to enable it:

Setsebool-P httpd_can_network_connect 1

If you visit it again, you can access it normally. Of course, you can also access it by directly closing SELinux, but it is not recommended to solve the problem in this way.

Temporary handling of nginx502 error methods

Nginx often occurs nginx 502bad gateway errors, check the log is the best way to solve the problem from the source, changed the nginx configuration or tuned nginx, can not immediately see the results, so it is best to write a temporary script, monitor the site's status code, once there is a 502 error, restart the nginx, and then start to solve the root causes of nginx 502 bad gateway, write a small script, then automated operation and maintenance tools at that time. The script function can be modified, the log / data/scripts/check502.log must be created manually, and the location can be defined by yourself. The content of the script is as follows:

The most important thing is the command: curl-- head https://blog.51cto.com/13696145 2 > & 1 | awk 'NR==4' | awk' {print $2}'to view the current status code vim / data _ day= _ check _ 502.shly _ blank _% _ 1 | awk'_ NR==4' | awk'{print $2} '`if ["$STATE"-eq "502"]. Then pkill-9 nginx & & sleep 1 & & / usr/local/nginx/sbin/nginx echo $day > > / data/scripts/check502.log echo "nginx restarted" > > / data/scripts/check502.log echo $day take a check!! > > / data/scripts/check502.logfi joins the scheduled task crontab-e and performs a check every 2 minutes * / 2 * / bin/bash-x / data/scripts/check_502.sh