28 June 2026 · Field notes
Timeouts that look like errors, errors that look like timeouts
A gateway is willing to call many failures by neighbouring numbers. 502, 503, 504, and a closed connection can sit in the same meeting under the word “errors.” They do not ask the same next question.
A 504, in the setups we most often read, is the front door giving up on an upstream that did not answer in time. The next look belongs to that upstream’s queue, its own timeouts, or a path that suddenly grew a heavy query. A 502 is often a bad hop: the upstream reset, refused, or sent something the proxy would not accept. A 503 can be the gateway itself shedding load, or an upstream asking to be left alone. If your vendor swaps these meanings, send the vendor’s dictionary with the logs.
Application 500s that pass through the gateway are a different ink. The upstream answered, and the answer was an error the application chose to emit. Restarting the proxy will not impress that code. Restarting the proxy may still show up on the strip, and we will mark whether it sat before or after the 500s.
Hung streams without a status are easy to miss because they never become a tidy count. If your log has connection-close reasons or upstream-status fields, send them. If it does not, the briefing will say that silent hangs are outside the sheet.
In the sitting we ask one rude question of each cluster: did the gateway wait, did the upstream speak, or did the application speak an error? Until that is answered, a change window is a guess. We would rather leave the question open on the last page than caption a chart with a cause the file cannot support.