服务器总是502，但是探针显示负载并不高

yanqzh

最近服务器总是出现502，特别是登录后台情况下。
前天刚重装系统，及环境，网站上线，发现总体情况很好，登录后台也没事。昨天太忙没时间 管，今天上去，发现又出现502。

vi wwwlogs/access/log

14.220.228.225 - - [27/Mar/2017:15:41:02 +0800] "GET /p.php?act=rt&callback=jQuery17019214045155609605_1490589645963&_=1490600457405 HTTP/1.1" 404 564 "http://111.111.111.111/p.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
219.159.230.131 - - [27/Mar/2017:15:41:04 +0800] "GET /youlian/ltyl.gif HTTP/1.1" 301 178 "http://www.zxls.com/" "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko" -
14.220.228.225 - - [27/Mar/2017:15:41:04 +0800] "GET /p.php?act=rt&callback=jQuery17019214045155609605_1490589645964&_=1490600459417 HTTP/1.1" 404 564 "http://111.111.111.111/p.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
219.137.174.166 - - [27/Mar/2017:15:41:05 +0800] "GET /youlian/ltyl.gif HTTP/1.1" 301 178 "http://www.zxls.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" -
222.173.168.46 - - [27/Mar/2017:15:41:05 +0800] "GET /youlian/ltyl.gif HTTP/1.1" 301 178 "http://www.zxls.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" -
14.220.228.225 - - [27/Mar/2017:15:41:06 +0800] "GET /p.php?act=rt&callback=jQuery17019214045155609605_1490589645965&_=1490600461417 HTTP/1.1" 404 564 "http://111.111.111.111/p.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
14.220.228.225 - - [27/Mar/2017:15:41:08 +0800] "GET /p.php?act=rt&callback=jQuery17019214045155609605_1490589645966&_=1490600463414 HTTP/1.1" 404 564 "http://111.111.111.111/p.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
94.23.23.194 - - [27/Mar/2017:15:41:08 +0800] "GET / HTTP/1.1" 301 178 "http://www.aaaaaaaaaa.com" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" -
222.209.210.179 - - [27/Mar/2017:15:41:09 +0800] "GET /youlian/ltyl.gif HTTP/1.1" 301 178 "http://www.zxls.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.154 Safari/537.36 LBBROWSER" -
14.220.228.225 - - [27/Mar/2017:15:41:10 +0800] "GET /p.php?act=rt&callback=jQuery17019214045155609605_1490589645967&_=1490600465405 HTTP/1.1" 404 564 "http://111.111.111.111/p.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
14.220.228.225 - - [27/Mar/2017:15:41:12 +0800] "GET /p.php?act=rt&callback=jQuery17019214045155609605_1490589645968&_=1490600467409 HTTP/1.1" 404 564 "http://111.111.111.111/p.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"


注：该段时间内，我已经将探针所在默认虚机停了——则将根目录改变名称，但仍发现有许多异常连接。

vi wwwlogs/nginx_error.log

2017/03/27 15:38:01 [crit] 12608#0: *103039 connect() to unix:/tmp/php-cgi.sock failed (2: No such file or directory) while connecting to upstream, client: 164.132.161.74, server: guoxuesg.com, request: "GET /modules/article/addbookcase.php?bid=129881&cid=5079817 HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-cgi.sock:", host: "guoxuesg.com"
PROFILE: interrupts/evictions/bytes = 4563/588/343208
PROFILE: interrupts/evictions/bytes = 4559/525/338096
2017/03/27 15:40:31 [crit] 4561#0: *7 connect() to unix:/tmp/php-cgi.sock failed (2: No such file or directory) while connecting to upstream, client: 123.126.113.82, server: www.aaaaaaaaaa.com, request: "GET /article-9530.html HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-cgi.sock:", host: "www.aaaaaaaaaa.com"
2017/03/27 15:46:02 [crit] 4560#0: *394 connect() to unix:/tmp/php-cgi.sock failed (2: No such file or directory) while connecting to upstream, client: 123.126.113.82, server: www.aaaaaaaaaa.com, request: "GET /article-3780.html HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-cgi.sock:", host: "www.aaaaaaaaaa.com"
2017/03/27 15:47:02 [crit] 4561#0: *458 connect() to unix:/tmp/php-cgi.sock failed (2: No such file or directory) while connecting to upstream, client: 123.126.113.82, server: www.aaaaaaaaaa.com, request: "GET /article-7017.html HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-cgi.sock:", host: "www.aaaaaaaaaa.com"
2017/03/27 15:48:02 [crit] 4561#0: *530 connect() to unix:/tmp/php-cgi.sock failed (2: No such file or directory) while connecting to upstream, client: 123.126.113.82, server: www.aaaaaaaaaa.com, request: "GET /docswf_wk-view.html?docid=27 HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-cgi.sock:", host: "www.aaaaaaaaaa.com"

licess

哪个是异常连接？
上面的是访问日志和nginx错误日志，这些在发生502时没用处，置顶帖中已经给出了具体可能的原因及排查方法
也可以直接去开php慢日志看看哪行程序执行有问题

yanqzh

昨日开启慢日志，但是vi  /usr/local/php/var/log/slow.log
内容为空
vi  /usr/local/php/var/log/php-fpm.log:
[29-Mar-2017 11:58:01] NOTICE: exiting, bye-bye!
[29-Mar-2017 11:58:02] NOTICE: fpm is running, pid 5546
[29-Mar-2017 11:58:02] NOTICE: ready to handle connections
[29-Mar-2017 11:59:02] NOTICE: Finishing ...
[29-Mar-2017 11:59:02] NOTICE: exiting, bye-bye!
[29-Mar-2017 11:59:03] NOTICE: fpm is running, pid 5571
[29-Mar-2017 11:59:03] NOTICE: ready to handle connections
[29-Mar-2017 12:00:02] NOTICE: Finishing ...
[29-Mar-2017 12:00:02] NOTICE: exiting, bye-bye!
[29-Mar-2017 12:00:03] NOTICE: fpm is running, pid 5603
[29-Mar-2017 12:00:03] NOTICE: ready to handle connections
[29-Mar-2017 12:01:01] NOTICE: Finishing ...
[29-Mar-2017 12:01:01] NOTICE: exiting, bye-bye!
[29-Mar-2017 12:01:02] NOTICE: fpm is running, pid 5662
[29-Mar-2017 12:01:02] NOTICE: ready to handle connections