Analyzer ngx-upstream-err-packets

# Name

ngx-upstream-err-packets - Capture the upstream packets that have specific error code

This analyzer captures network packets for HTTP upstream requests that result in specific error status codes (such as 502 or 504) in NGINX-based applications. It monitors upstream communication and records packet-level data when error conditions occur. The analyzer generates PCAP files containing the captured packets, enabling detailed inspection of network-level issues causing upstream failures. This is particularly useful for diagnosing connection problems, timeout issues, and premature connection closures between NGINX and upstream servers.

# Resource Category

Network I/O.

# Application Type & Technical Stack

• OpenResty
• Nginx
• Kong
• APISIX

# Command Line Syntax

The analyzer can be invoked directly on the command-line via the orxray utility from the openresty-xray-cli software package.

Alternatively, the analyzer can also be invoked manually or automatically on the web console UI of OpenResty XRay (like on the Advanced web page).

# PID is the target process PID.
orxray analyzer run ngx-upstream-err-packets -p PID

# trace a shell command directly
orxray analyzer run ngx-upstream-err-packets -c SHELL_CMD

# PGID is the process group ID or any process's PID within the target process
# group.
orxray analyzer run ngx-upstream-err-packets -p -PGID

# trace any processes started from the specified executable path.
orxray analyzer run ngx-upstream-err-packets --exe /path/to/exe/file

# Tracing Multiple Processes

Supported.

# Output Formats

• Plain Texts

# Output Example

{
  "flows": [
      {
          "remote_addr": "1.2.3.4 443",
          "flow": "flow_0.pcap",
          "packets_count": "6",
          "req_time": "218",
          "local_addr": "172.17.11.240 45086",
          "timeout": "0",
          "req": "GET https://test.com/repomd.xml",
          "desc": "Event Time: Thu, 04 Dec 2025 07:50:34 GMT\nLocal address: 172.17.11.240:45086\nRemote address: 1.2.3.4:443\nHTTP request: 'GET https://test.com/repomd.xml'",
          "time": "1764834634914667",
          "status": "404"
      },
      {
          "remote_addr": "1.2.3.4 443",
          "flow": "flow_1.pcap",
          "packets_count": "47",
          "req_time": "47",
          "local_addr": "172.17.11.240 36930",
          "timeout": "0",
          "req": "GET https://test.com/dashboard/register/",
          "desc": "Event Time: Thu, 04 Dec 2025 07:50:47 GMT\nLocal address: 172.17.11.240:36930\nRemote address: 1.2.3.4:443\nHTTP request: 'GET https://test.com/dashboard/register/'",
          "time": "1764834647277989",
          "status": "404"
      }
  ],
  "timedout_num": 0
}

# Author

The OpenResty Inc. Team.

# Copyright

Copyright (C) by OpenResty Inc. All rights reserved.