Access log configuration in Nginx - Commands & Configuration

Introduction

Access logs record every request made to your web server. Configuring access logs helps you see who visits your site and what they do, which is useful for troubleshooting and understanding traffic.

When you want to track visitor activity on your website to improve user experience.

When you need to debug issues by checking what requests your server received.

When you want to monitor traffic patterns for security or performance reasons.

When you want to analyze which pages are most popular on your site.

When you need to keep records for compliance or auditing purposes.

Config File - nginx.conf

nginx.conf

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    server {
        listen 80;
        server_name example.com;

        location / {
            root /usr/share/nginx/html;
            index index.html index.htm;
        }
    }
}

The log_format directive defines a custom format named main for access logs, specifying what details to record for each request.

The access_log directive sets the file path where logs are saved and applies the main format.

The server block configures a basic web server listening on port 80 for example.com.

Commands

Check the Nginx configuration file for syntax errors before applying changes.

Terminal

sudo nginx -t

Expected Output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

Reload Nginx to apply the new access log configuration without stopping the server.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

View the last 5 lines of the access log to verify that requests are being logged correctly.

Terminal

tail -n 5 /var/log/nginx/access.log

Expected Output

192.168.1.10 - - [27/Apr/2024:14:22:10 +0000] "GET /index.html HTTP/1.1" 200 612 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" "-"

192.168.1.11 - - [27/Apr/2024:14:22:15 +0000] "GET /favicon.ico HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" "-"

Key Concept

If you remember nothing else from this pattern, remember: access logs record every request your server handles, and configuring them helps you monitor and troubleshoot your website.

Common Mistakes

Forgetting to reload Nginx after changing the access log configuration.

The new logging settings won't take effect until Nginx reloads the configuration.

Always run 'sudo nginx -t' to test, then 'sudo systemctl reload nginx' to apply changes.

Setting the access log file path to a directory without write permission.

Nginx will fail to write logs, causing errors and no logs being recorded.

Ensure the log file path is writable by the Nginx user, typically /var/log/nginx/access.log.

Summary

Define a log format using the 'log_format' directive to specify what details to record.

Set the 'access_log' directive with the file path and format to enable logging.

Test the configuration with 'nginx -t' and reload Nginx to apply changes.

Check the access log file to verify that requests are being logged.

Practice

1. What is the main purpose of the access_log directive in nginx?

easy

A. To record details of every request made to the server

B. To block unwanted IP addresses

C. To restart the nginx service

D. To configure server SSL certificates

Solution

1. Step 1: Understand the role of access logs

   Access logs keep track of every request made to the server, helping monitor traffic and troubleshoot issues.

2. Step 2: Identify the function of access_log

   The access_log directive in nginx specifies where and how these request details are recorded.

3. Final Answer:

   To record details of every request made to the server -> Option A

4. Quick Check:

   Access logs = record requests [OK]

Hint: Access logs always record requests, not block or restart [OK]

Common Mistakes:

• Confusing access_log with security or restart commands
• Thinking access_log blocks IPs
• Assuming access_log manages SSL

2. Which of the following is the correct syntax to enable access logging to a file named /var/log/nginx/access.log with the default format?

easy

A. access_log /var/log/nginx/access.log off;

B. access_log /var/log/nginx/access.log default;

C. access_log /var/log/nginx/access.log main;

D. access_log /var/log/nginx/access.log;

Solution

1. Step 1: Recall default access_log syntax

   The access_log directive requires the log file path and optionally a format. If no format is given, the default is used.

2. Step 2: Analyze each option

   access_log /var/log/nginx/access.log main; uses 'main' which is predefined but different from the default 'combined'; access_log /var/log/nginx/access.log default; uses 'default' which is not a valid format name; access_log /var/log/nginx/access.log; correctly specifies only the file path, using default format implicitly; access_log /var/log/nginx/access.log off; disables logging with 'off'.

3. Final Answer:

   access_log /var/log/nginx/access.log; -> Option D

4. Quick Check:

   Default format = omit format name [OK]

Hint: Omit format name to use default logging [OK]

Common Mistakes:

• Using invalid format names like 'default'
• Adding 'off' disables logging
• Using 'main' which is not the default format

3. Given this nginx config snippet:

access_log /var/log/nginx/access.log custom_format;
log_format custom_format '$remote_addr - $remote_user [$time_local] "$request" $status';

What will be logged for a request from IP 192.168.1.10 with user 'john' requesting GET /home and status 200?

medium

A. john - 192.168.1.10 [time] "GET /home" 200

B. 192.168.1.10 - john [time] "GET /home" 200

C. 192.168.1.10 - - [time] "GET /home" 200

D. 192.168.1.10 john [time] GET /home 200

Solution

1. Step 1: Understand the log_format string

   The format is: $remote_addr - $remote_user [$time_local] "$request" $status. This means IP, dash, username, time, request in quotes, and status code.

2. Step 2: Substitute values from the request

   IP is 192.168.1.10, user is 'john', request is 'GET /home', status is 200. Time is shown as [time] placeholder.

3. Final Answer:

   192.168.1.10 - john [time] "GET /home" 200 -> Option B

4. Quick Check:

   Format matches IP - user [time] "request" status [OK]

Hint: Match variables exactly as in log_format string [OK]

Common Mistakes:

• Mixing order of IP and user
• Omitting dashes or quotes
• Confusing $remote_user with $remote_addr

4. You configured access_log /var/log/nginx/access.log combined; but no logs appear. What is the most likely error?

medium

A. The 'combined' log format is not defined in nginx config

B. The log file path is incorrect

C. The access_log directive disables logging by default

D. Nginx does not support custom log formats

Solution

1. Step 1: Understand the 'combined' format usage

   'combined' is a common log format but must be defined with log_format directive in nginx config before use.

2. Step 2: Analyze why logs don't appear

   If 'combined' is not defined, nginx ignores the logging directive or fails silently, so no logs are written.

3. Final Answer:

   The 'combined' log format is not defined in nginx config -> Option A

4. Quick Check:

   Undefined format = no logs [OK]

Hint: Define custom formats before using them in access_log [OK]

Common Mistakes:

• Assuming 'combined' is built-in by default
• Ignoring file permission issues
• Thinking access_log disables logging by default

5. You want to log only requests with status code 400 or higher to /var/log/nginx/error_access.log and all requests to the default access log. Which configuration snippet achieves this?

hard

A. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status > 399;

B. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status >= 400;

C. map $status $log_error { ~^[4-9] 1; default 0; }
access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$log_error;

D. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status eq 400;

Solution

1. Step 1: Understand conditional logging in nginx

   nginx supports conditional logging using the if= parameter with variables and expressions.

2. Step 2: Use a map to create a variable for status >= 400

   Direct comparisons like '$status >= 400' are not supported in if=. Instead, a map is used to set a variable $log_error to 1 for status codes 400 and above.

3. Step 3: Apply conditional logging using the variable

   Use if=$log_error in the access_log directive to log only those requests.

4. Final Answer:

   map $status $log_error { ~^[4-9] 1; default 0; } access_log /var/log/nginx/access.log; access_log /var/log/nginx/error_access.log combined if=$log_error; -> Option C

5. Quick Check:

   Conditional logging requires map + if= variable [OK]

Hint: Use map to create condition variable for logging [OK]

Common Mistakes:

• Trying to use direct comparison in if= condition
• Not defining a map for conditional logging
• Expecting nginx to parse expressions in if= directly