Symptoms

In a multi-node environment, the number of log entries is significantly different during a specific period in different nginx.service.log files (one per node) ( Download logs from an appliance ). 

Significant means that for instance, one node gets more than double the amount of requests compared to the others.

Hint: Only consider the lines containing the host header(s), e.g. lines with "workspace.company.org".

Cause

There is an error somewhere in the network configuration, e.g. on the firewall, load balancer or reverse proxy server in front of Parallels Secure Workspace.

Some examples of misconfiguration:

• The load balancer only points to one node.
• The load balancer is pointing to multiple nodes, but in an active/passive or failover configuration.
• The Parallels Secure Workspace environment is accessible in multiple ways, e.g. directly from an internal network with internal DNS servers only pointing to one IP address while incoming connections from the Internet are properly load balanced.
• ...

Resolution

Parallels Secure Workspace itself does not perform any load balancing of the inbound HTTP requests.

While the exact configuration of such a physical or virtual network device is out of scope (for our support), the Admin Manual contains some pointers and an example configuration for Nginx.

After addressing the configuration issue, it's possible to export the appliance log files again.