Logging HTTP header that is longer than the maximum allowed

Just to clarify, although I can see how the error message could be interpreted this way, it is referring to the total size of all HTTP headers, not any one specific header. So if you have a request with 10 headers that are each 4k long, you'd still hit the limit. If this header size limit is exceeded, then we stop parsing the headers, and kill the connection (so HTTP_REQUEST is indeed never triggered in this case).

 

 

If you still want to track down an example request which is triggering this condition, then Aaron's tcpdump suggestion is a good one.