nginx + php-fpm故障一例

配置Nginx + php-fpm时遇到一个偶然性问题，浪费了我一个下午！ 
访问PHP页面时，nginx总是提示错误，一个劲重装排查搞不定。关键是这个问题偶尔能复现，有时又消失。

2014/04/19 08:25:25 [error] 2601#0: *14 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 142.116.118.16, server: i.isclab.org, request: “GET /wp-content/plugins/wp-codebox/wp-codebox.php?download=download.txt&p=192 HTTP/1.1″, upstream: “fastcgi://127.0.0.1:9000″, host: “i.isclab.org”

查看nginx的error日志，看到如下信息：

? Downloaddownload.txt

2014/04/19 08:25:25 [error] 2601#0: *14 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 142.116.118.16, server: i.isclab.org, request: "GET /wp-content/plugins/wp-codebox/wp-codebox.php?download=download.txt&p=192 HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "i.isclab.org" 2014/04/19 08:25:26 [error] 2601#0: *16 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 42.156.139.16, server: i.isclab.org, request: "GET /?p=368 HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "i.isclab.org" 2014/04/19 08:25:29 [error] 2601#0: *19 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 42.156.137.16, server: i.isclab.org, request: "GET /?p=347 HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "i.isclab.org"

诊断过程如下：

? Downloaddownload.txt

vi /etc/php-fpm.d/www.conf # catch_workers_output = yes # 取消该行的注释 service php-fpm restart

重新访问php页面，看php-fpm的日志。

? Downloaddownload.txt

tail -f /var/log/php-fpm/*.log

发现如下信息：

? Downloaddownload.txt

[19-Apr-2014 08:25:29] WARNING: [pool www] child 2622 said into stderr: "ERROR: Connection disallowed: IP address '116.126.110.209' has been dropped." [19-Apr-2014 08:25:35] WARNING: [pool www] child 2623 said into stderr: "ERROR: Connection disallowed: IP address '116.126.110.209' has been dropped." [19-Apr-2014 08:25:35] WARNING: [pool www] child 2624 said into stderr: "ERROR: Connection disallowed: IP address '116.126.110.209' has been dropped."

这时候明白是怎么回事了！原来nginx连接php-fpm用的源地址是公网地址而不是127.0.0.1. 
yum安装的php-fpm只允许127.0.0.1连接！

临时解决办法： 
修改php-fpm参数allowed_clients，增加一个nginx的源地址。

? Downloaddownload.txt

vi /etc/php-fpm.d/www.conf # listen.allowed_clients = 127.0.0.1,116.126.110.209 # IP地址白名单中增加服务器公网IP ; List of ipv4 addresses of FastCGI clients which are allowed to connect. ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original ; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address ; must be separated by a comma. If this value is left blank, connections will be ; accepted from any ip address. ; Default Value: any

遗留问题： 
怎么设置nginx访问php-fpm使用127.0.0.1作为源地址！？跟参数 FCGI_WEB_SERVER_ADDRS 有关吗？ 
如果你知道具体怎么解决，麻烦告诉我一声。 
太饿了，吃饭去……