I thought of many of the same things when I first stated looking at this.

The first logs I looked at were the apache logs, but this really isn't a 500 error, so it is nearly impossible to put the request together with anything on the apache side.

Unfortunately, this monitoring script doesn't record response time. That's something we need to add because, as you rightly point out, this would be a good extra piece of information. However, in this case I assume it would be 60 seconds since that's the timeout.

Correlating with other data is also difficult because we have a farm-type architecture. Other monitoring scripts may or may not be hitting the same servers as this one because we hit the front door.

As far as other logs, the only thing I could think of were SSL logs.

Thanks for the suggestions.