What it means
nginx tracks failures per server of an upstream block. By default one failed attempt (max_fails=1) marks a server unavailable for 10 seconds (fail_timeout=10s). When every server in the group is unavailable at once, nginx has nowhere to send the request and returns 502 Bad Gateway without opening a connection.
[error] 1234#1234: *301 no live upstreams while connecting to upstream, client: 203.0.113.7, server: example.com, request: "GET / HTTP/1.1", upstream: "http://backend/"Note the upstream field: it names the group (backend), not an IP.
Common causes
1. All servers failed just before. Look at what nginx logged in the seconds before the first occurrence:
sudo grep -E "connect\(\) failed|timed out|prematurely closed|no live upstreams" /var/log/nginx/error.log | tail -n 302. The nginx-proxy placeholder. With nginx-proxy (docker-gen) in Docker, a container the proxy cannot reach, usually because it is not on the proxy's network, ends up as server 127.0.0.1 down; in the generated config. Confirm:
docker exec nginx-proxy nginx -T | grep -A4 "upstream"3. A config that marks servers down. A down flag left after maintenance, or only backup servers left in the group.
4. Thresholds too strict for a blip. With max_fails=1, a short deploy or a restart on each server in turn can mark the whole group down for 10 seconds.
How to fix
- Fix the error that appeared first, using its own page below. This message disappears with it.
- For nginx-proxy, attach the app container to the proxy's network and check that
VIRTUAL_HOSTandVIRTUAL_PORTmatch what the app listens on. - Remove stray
downflags and check the group withsudo nginx -T. - If short blips trip the group, loosen the thresholds, for example
server 10.0.1.12:8080 max_fails=3 fail_timeout=30s;, and restart backends one at a time. - Test and reload:
sudo nginx -t && sudo systemctl reload nginx.
Is it just you?
Check the public URL from several regions with Is my site down? to see whether every visitor gets the 502.
Get alerted next time
- An HTTP monitor fails as soon as nginx answers 502 instead of the status code you expect.
- Each failure is rechecked from your other regions before an outage opens, so a 10-second blip does not page anyone.
- A TCP port monitor per backend, when the ports are reachable from outside, shows which server of the group stopped listening.
FAQ
Can no live upstreams happen with a single server? ▼
Not from failed attempts: with one server in the group, nginx ignores max_fails and fail_timeout and never marks it unavailable. You can still see it with one server if that server is marked down in the config, which is what nginx-proxy writes when it cannot reach the container.
How long does nginx keep a server marked unavailable? ▼
For fail_timeout, 10 seconds by default, after max_fails failed attempts, 1 by default. After that window nginx tries the server again with a live request. Open source nginx has no active health checks, so recovery is detected by real traffic.
Should I set max_fails=0? ▼
It stops nginx from marking servers down, so you will no longer see this message, but requests will keep hitting a dead server and fail one by one. Raising max_fails and fail_timeout slightly, and fixing the backend, is usually better.