WittCode💻

Nginx Access and Error Logs

By

Learn how to monitor user activity and errors with Nginx by using error and access logs. We will go over configuring these logs with the log_format, access_log, and error_log directives.

Table of Contents 📖

Error Logs

When Nginx faces any issues, whether it be a configuration file error or Nginx is abruptly stopped, details of the error will be written to an error log. These details consist of the error's severity level and information. Below is an example of an error log.

2024/05/08 19:55:15 [error] 29#29: *1 open() "/usr/share/nginx/html/nuts" failed (2: No such file or directory), client: 172.17.0.1, server: localhost, request: "GET /nuts HTTP/1.1", host: "localhost:6464"

Here, Nginx is trying to access a file that doesn't exist. The severity of this error is set to error. Error logs are configured with the error_log directive.

error_log  /var/log/nginx/error.log notice;

Here is the syntax of the error_log directive.

error_log <ERROR_LOG_FILE_PATH> <ERROR_LEVEL>;
  • ERROR_LOG_FILE_PATH - The path to the error log file.
  • ERROR_LEVEL - The severity level of the logging. Can be one of debug, info, notice, warn, error, crit, alert, or emerg. Note that these are in order of severity.

INFO: By default Nginx error logs are located in the logs/error.log file. The absolute path depends on the installation method and operating system. The default error level is error.

When setting the level of logging, all log levels above the specified level will be logged. For example, specifying debug will cause everything to be logged while specifying warn will cause warn, error, crit, alert, and emerg to be logged. The error_log directive can be placed in the main, http, stream, server, and location levels.

server {
  listen       80;
  listen  [::]:80;
  server_name  localhost;

  root /usr/share/nginx/html;
  error_log /var/log/nginx/server-error.log debug;

  location /api {
    error_log /var/log/nginx/api-error.log error;
    proxy_pass http://backend/api;
  }
}

If the error_log directive is specified at multiple levels, the most specific context will contain the error log. If several error_log directives are at the same level, then the error is written to each log.

Access Logs

When Nginx processes a request, it will log information about the request to an access log. For example, we can log the IP address of the client, their user agent, status code of the response, etc. Below is an example of an access_log.

172.17.0.1 - - [08/May/2024:18:32:52 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"

Access logs are configured using the access_log directive with a log format specified by the log_format directive.

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  '$status $body_bytes_sent "$http_referer" '
  '"$http_user_agent" "$http_x_forwarded_for"';

access_log  /var/log/nginx/access.log  main;

The syntax of the access_log directive is as follows:

access_log <ACCESS_LOG_FILE_PATH> <ACCESS_LOG_FORMAT_NAME>;
  • ACCESS_LOG_FILE_PATH - The path to the access log file.
  • ACCESS_LOG_FORMAT - The format for the logs placed in the access log.

INFO: By default, Nginx writes access logs to the logs/access.log file. The absolute path depends on the installation method and operating system.

The syntax of the log_format directive is as follows:

log_format <FORMAT_NAME> <FORMAT>;
  • FORMAT_NAME - The name of the format.
  • FORMAT - A string specifying the fomat for the log.

Just like the error_log directive, if the access_log directive is specified at multiple levels, the most specific context will contain the access log.

server {
  listen       80;
  listen  [::]:80;
  server_name  localhost;

  root /usr/share/nginx/html;
  access_log  /var/log/nginx/access.log  main;

  location /api {
    access_log /var/log/nginx/localhost-api.log main;
    proxy_pass http://backend/api;
  }
}

Here, whenever a request is made to the server api location, it will be logged to the localhost-api.log file while everything else is logged to the access.log file.

INFO: If several access_log directives are at the same level, then the access log is written to each log.