Random “400 Bad Request” Errors with EA-NGINX + mod_lsapi — No Logs, Nothing Useful

lulzkiller

• May 31, 2025 00:23

Hi everyone,

I’m seeing completely random 400 Bad Request errors on a CloudLinux + cPanel server using EA-NGINX (as a reverse proxy) and mod_lsapi. It happens on low-traffic domains as well as high-traffic ones, and it’s getting extremely frustrating, no limits are being hit in CL or ressources

Summary of the Issue:

• The error is: 400 Bad Request

• It’s entirely random — refreshing the page again works instantly.

• The issue only happens when EA-NGINX is installed.

• If I remove EA-NGINX, the problem disappears completely and cannot be reproduced — even after hundreds of refreshes.

• Reinstalling EA-NGINX brings the error back and I can provoke it again with repeated requests.

What I’ve Tried:

• Tried alt-php, ea-php, with and without PHP-FPM.

• Tried setting LSAPI_REUSE=0 in /etc/cl.selector/global.env.

• Tried adjusting LSAPI limits and disabling reuse.

• Checked /var/cache/ea-nginx/proxy/ — saw some unlink() errors, but timestamps do not match the 400 error.

• Tail’d nginx, apache, and modsec logs live — absolutely nothing is shown when the 400 error occurs.

• Increased NGINX logging to debug — still no output at all during the error.

• Monitored file descriptors, memory, load — no system limits reached.

Even cloudlinux have spent 2 days trying to help me figuring it out with their techs, but unfortunately without a solution.

Do any of you know what could be wrong ?

• 

  cPRex Jurassic Moderator

  • June 02, 2025 19:55

  Hey there!  Does your system happen to have mod_evasive installed?  That can cause these seemingly random issues, but it might be best to create a ticket so someone can test this in real-time on the machine.

  0
• 

  lulzkiller

  • June 02, 2025 19:59

  No mod_evasive installed, and unfortunately I cannot create a ticket because my license is via hetzner.
  
  But I figured so much that the problem is with nginx. If I remove nginx, the problem goes away, and if I install it again, the problem comes back.
  
  The funky part is, I did not have this problem before I actually started using the cloudlinux php versions, so it's "something" between cloudlinux php, and nginx thats creating it, but weirdly enough when I changed the php back to the normal one, I still had the problem. So it came "somewhere" after using cloudlinux php, and did not go away by changing it back, only the removal of nginx solved it

  0
• 

  cPRex Jurassic Moderator

  • June 02, 2025 20:01

  Hetzner *should* escalate the ticket to us if they aren't able to resolve the issue.  I don't have any other ideas off the top of my head, especially if the CloudLinux team has already taken a look directly.

  0
• 

  lulzkiller

  • June 02, 2025 20:05

  Yeah hetzner never does that unfortunately, they just say "we dont offer support on cpanel" x) 
  
  And yes its a very mystic issue since there is legit no logs about it anywhere.
  
  I spent a few weeks on the issue
  CL spend 2 days, and they are very clever
  ChatGPT and Claude.ai can't find a solution as well.
  
  So yes its a bug somewhere that doesn't log anything.
  
  I have been thinking to buy a 1 month license for cpanel just to get the support to solve it, but I dont think I can just move license and hetzner dont sell licenses anymore so I dont want to risk getting stuck with a  $400 monthly license due to the amount of users I have x) So for now I just live without nginx unfortunately 

  0
• 

  cPRex Jurassic Moderator

  • June 02, 2025 20:26

  There's no reason (from our side) that you can't move a license - it happens all the time!

  0

Please sign in to leave a comment.