# Find out which process sends HTTP requests

**URL:** <https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080>\
**Category:** Elasticsearch\
**Created:** [September 11, 2019, 12:35pm UTC](https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080 "2019-09-11T12:35:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [September 11, 2019, 12:35pm UTC](https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080/1 "2019-09-11T12:35:20Z")

</div>

Hi!

I've enabled security on my cluster and more or less everything went as expected, except for one node (out of 10) where I get a long warning message every 5 minutes:

```
[2019-09-11T11:50:02,010][WARN][o.e.h.AbstractHttpServerTransport] [elastic.local.lan] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=0.0.0.0/0.0.0.0:9200, remoteAddress=/10.50.90.5:60000}
io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record:

```

I can't find out what causes this.  
The node has Filebeat, Metricbeat, Logstash installed but none of those have anything in their logs. Any ideas how could I identify the culprit?

Thank you!  
YvorL

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [September 11, 2019, 2:18pm UTC](https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080/2 "2019-09-11T14:18:32Z")

</div>

1. Go to `10.50.90.5` and run

2. The message you shared has a long hex string after that. This is the actual incoming HTTP request. Run

---

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [September 11, 2019, 2:37pm UTC](https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080/3 "2019-09-11T14:37:55Z")

</div>

First of all, huge thanks! 🙂

Unfortunately, the grep wouldn't work because the requests always used differents ports. However, decoding the message lead to this:

> PUT /\_all/\_settings HTTP/1.1  
> Host: 10.50.90.5:9200  
> Authorization: Basic XXXXXXXXXXXXXXXXX  
> User-Agent: curl/7.47.0  
> Accept: _/_  
> Content-Length: 38  
> Content-Type: application/x-www-form-urlencoded  
> {  
> "index.number\_of\_replicas" : "0"  
> }

Is this something inside ES or this is a custom request?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [September 11, 2019, 2:49pm UTC](https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080/4 "2019-09-11T14:49:09Z")

</div>

> [@YvorL](#):
>
> User-Agent: curl/7.47.0

This is something running curl trying to [update the settings](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/indices-update-settings.html) for all indices . Some cronjob someone is running ?

If you base64 decode XXXXXXXXXXXXXXXXX, maybe the username will give you a hint ?

---

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [September 11, 2019, 3:28pm UTC](https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080/5 "2019-09-11T15:28:23Z")

</div>

Thanks again!

Have a nice day!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2019, 3:39pm UTC](https://discuss.elastic.co/t/find-out-which-process-sends-http-requests/199080/6 "2019-10-09T15:39:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.