Large file uploads fail; why?

Short answer

The status code and who produced the response show the cause. If a 413 or the application's own error comes from the Backend Service, the limit is on the server (e.g. the body size limit of the web server). The common causes on the TR7 side are the Raw Body Size constraint and the Allowed Upload Mime Types list of WAF (default Blocking Status Code 418), a Block action bound to a size condition, the Server Timeout (504) that expires during processing after the upload has finished, and the Client Timeout in which the client stays silent during the upload. On vServices with WAF or Debug mode on, the first part of the request that is buffered must arrive within HTTP Request Timeout (default 30 s); if it does not, 408 is returned. Buffer Size(kB) in vService Limits does not limit the size of the file that can be uploaded.

Possible Causes

Symptom	Backend service	Cause	Page to check
413 or the error page of the application	Server name	Body size limit of the Backend Service	Server setting (web server or application)
The code selected in the Block action (e.g. 413)	TR7	Block action bound to a Content-Length condition	Can I block large requests (e.g. above a certain size)?
418 or the WAF block page	TR7	WAF: Raw Body Size range, Allowed Upload Mime Types, Allowed Raw Body Mime Types, Block Unparsed Contents	The violation in WAF Event Logs is read; the constraint or the list is extended
408	TR7	While WAF or Debug mode is on, the first part of a slow upload does not arrive within HTTP Request Timeout	What do the values in the Timeouts profile (HTTP Keepalive Timeout, HTTP Request Timeout, Connect, Server, Client, Queue, Tunnel(Websocket) Timeout, Client FIN, Server FIN) mean?
The connection drops in the middle of the upload	-	Client timeout: the client did not send data during the period	Why is the request cut off during long operations (report, file upload); which timeout should I increase?
504 after the upload finishes	Server name	Server timeout: the time expired before the server finished processing and responded	I get 504 Gateway Timeout; which timeout should I check?
502	Server name	The Backend Service closes the connection early or gives an invalid response	I get 502 Bad Gateway; what are the possible causes?
Very slow, then a timeout	-	Upload limit in the Bandwidth Limitation action or the line capacity	Can I limit bandwidth (download / upload)?
403	TR7	Bot/DDoS (L7 DDoS Protection) or Quarantine block	Legitimate users are being blocked; how do I find which rule is blocking them?

Definitive rules:

• The Backend Service value in HTTP logs is TR7 if no Backend Service was selected for the request, Cache if the response was served from the cache, and the name of that Backend Service if one was selected. TR7 produces 502 and 504, but the name of the server is written in the record.
• Buffer Size(kB) (default 128 kB) does not limit the file size; the body passes to the Backend Service by flowing through the buffer (What is Buffer size used for; when should I change it?).
• In the WAF default rule, the Raw Body Size range is 1 – 268,435,456 bytes (256 MiB). The ready-made list of Allowed Upload Mime Types contains octet-stream, PDF, plain text, CSV, JSON, ZIP, JPEG, PNG, GIF, WebP, SVG, DOCX, XLSX and PPTX; a file type that is not in the list (e.g. MP4, the old DOC or XLS) is blocked in Blocking mode.
• While WAF is on, if Wait for body for a time is not selected (default), the request body is waited for by being buffered; this wait is subject to the HTTP Request Timeout duration. If it is selected, the body is waited for at most the Time to Wait Body duration (default 300 ms).

Where Is It Monitored?

Screen	Path	What it shows
HTTP Logs	Load Balancer vServices → vService → Logs & Tracking	Status code, Backend service, Size Info in the preview (uploaded size)
Debug Mode Logs	In the same tab (while the vService is in Debug mode)	Termination state and Security action
WAF Event Logs	WAF-Protected vServices → vService → Event Logs	The type of the WAF violation and the related rule
Request Body Limits	WAF Management → Inspection & Blocking	The settings with which WAF processes and waits for the body

How to Diagnose?

1. The status code and the moment of the error (during the upload or after it has finished) are determined.
2. Left Monitor Panel → Load Balancer vServices → vService → Logs & Tracking → HTTP Logs is opened; the Backend Service value of the record and the Size Info value in the preview are checked.
3. If the status is 408, 502 or 504, or if the value is TR7, the Status field of the HTTP vService is set to Debug mode, the upload is repeated, and Termination State and Security action are read in Debug mode logs: During request · Client timeout indicates 408, and During response headers · Server timeout indicates 504 (How do I find out from the logs why a request failed (termination state)?). Since Debug mode also buffers the request body, Status is set back to Enabled when the examination is finished.
4. If it is a WAF block, the violation type is read in WAF-Protected vServices → vService → Event Logs; the Request Body Limits card and the RAW and Form constraints under Page Types are examined.
5. The size-conditioned Block actions on the vService, the assigned Timeouts profile and the bandwidth settings are checked.
6. If the value is a server name and the Termination state is Normal, the response was produced by the application; the web server and application logs are examined.

Common Misconceptions

• "Buffer size(kB) is the upload limit." The body passes by flowing through the buffer; Buffer size(kB) does not limit the file size.
• "Uploads that pass while WAF is in Learning mode also pass in Blocking." Structural constraints (size, file type) are applied in Blocking mode; before the switch, the violations in Event Logs are examined.
• "A Content-Length condition catches all uploads." Bodies sent in parts (chunked) have no Content-Length header.
• "Increasing the Server timeout on all vServices is enough." For long operations, a separate Timeouts profile is defined and assigned only to the relevant vService (Why is the request cut off during long operations (report, file upload); which timeout should I increase?).

How it is done in the documentation

• WAF Raw · Raw Body Size
• WAF Form · Allowed Upload Mime Types
• Request Body Limits · Wait for Body for a Time
• Timeouts · Client Timeout

Related questions

• Why is the request cut off during long operations (report, file upload); which timeout should I increase?
• Can I block large requests (e.g. above a certain size)?
• I get 504 Gateway Timeout; which timeout should I check?