Access log configuration in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this nginx access log format?

Given the following nginx access log format configuration, what will be the exact log output for a request with client IP 192.168.1.10, method GET, URI /home, status 200, and response time 0.123 seconds?

Nginx

log_format custom '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" $request_time';
access_log /var/log/nginx/access.log custom;

A 192.168.1.10 - - [27/Apr/2024:12:00:00 +0000] "POST /home HTTP/1.1" 200 0 "-" "Mozilla/5.0" 0.123

B 192.168.1.10 - - [27/Apr/2024:12:00:00 +0000] "GET /home HTTP/1.1" 404 0 "-" "Mozilla/5.0" 0.123

C 192.168.1.10 - - [27/Apr/2024:12:00:00 +0000] "GET /home HTTP/1.1" 200 0 "-" "Mozilla/5.0" 0.123

D 192.168.1.10 - - [27/Apr/2024:12:00:00 +0000] "GET /home HTTP/1.1" 200 512 "-" "Mozilla/5.0" 0.123

💡 Hint

Focus on the variables used in the log_format and the request details given.

The log format uses variables like $remote_addr for client IP, $request for method and URI, $status for HTTP status, and $request_time for response time. The example request is GET /home with status 200 and response time 0.123 seconds, so option C matches exactly.

❓ Configuration

intermediate

Which configuration disables access logging for a specific location?

You want to disable access logging only for requests to the /healthcheck location in nginx. Which configuration snippet achieves this?

A

location /healthcheck {
    error_log off;
}

B

location /healthcheck {
    access_log off;
}

C

location /healthcheck {
    access_log /dev/null;
}

D

location /healthcheck {
    access_log /var/log/nginx/health.log off;
}

💡 Hint

Look for the directive that explicitly disables access logging.

The directive access_log off; disables access logging for the specified location. Option B correctly uses this syntax. Option B is invalid because off cannot be used with a file path. Option B sends logs to /dev/null but does not disable logging. Option B disables error logging, not access logging.

❓ Troubleshoot

advanced

Why are no access logs generated despite configuration?

An nginx server has this configuration: access_log /var/log/nginx/access.log combined; location /api { access_log off; } However, no logs are generated at all, even for requests outside /api. What is the most likely cause?

A Nginx needs to be restarted after changing access_log directives to enable logging.

B The combined log format is invalid and prevents logging.

C The main access_log directive is overridden by the location block with access_log off, disabling logging globally.

D The /var/log/nginx/access.log file has incorrect permissions preventing writing logs.

💡 Hint

Consider file system permissions and how nginx writes logs.

If the log file cannot be written due to permission issues, no logs will appear. The location block disables logging only for /api, so other requests should still log. The combined format is standard and valid. Nginx reload or restart is needed only after config changes, but the question implies config is active.

🔀 Workflow

advanced

Order the steps to enable custom access logging in nginx

Put these steps in the correct order to enable a custom access log format and activate it in nginx.

A 4,1,3,2

B 1,4,3,2

C 1,4,2,3

D 4,3,1,2

💡 Hint

Think about editing config first, then defining format, then enabling it, then reloading.

First, edit the config file (4), then define the log_format (1), then set access_log with that format (3), finally reload nginx (2) to apply.

✅ Best Practice

expert

Which is the best practice for managing access logs in a high-traffic nginx server?

For a high-traffic nginx server, which approach is best to manage access logs efficiently and avoid performance issues?

A Use asynchronous logging with a dedicated log processor and rotate logs frequently.

B Disable access logs completely to save disk space and CPU.

C Write access logs to a single large file without rotation to simplify management.

D Log only error messages and ignore access logs to reduce overhead.

💡 Hint

Consider performance and log management best practices for busy servers.

Disabling logs (B) loses valuable data. Writing to a single large file (C) risks disk space and slowdowns. Logging only errors (D) misses access info. Using asynchronous logging with a log processor and rotating logs (A) balances performance and data retention.

Practice

1. What is the main purpose of the access_log directive in nginx?

easy

A. To record details of every request made to the server

B. To block unwanted IP addresses

C. To restart the nginx service

D. To configure server SSL certificates

Solution

1. Step 1: Understand the role of access logs

   Access logs keep track of every request made to the server, helping monitor traffic and troubleshoot issues.

2. Step 2: Identify the function of access_log

   The access_log directive in nginx specifies where and how these request details are recorded.

3. Final Answer:

   To record details of every request made to the server -> Option A

4. Quick Check:

   Access logs = record requests [OK]

Hint: Access logs always record requests, not block or restart [OK]

Common Mistakes:

• Confusing access_log with security or restart commands
• Thinking access_log blocks IPs
• Assuming access_log manages SSL

2. Which of the following is the correct syntax to enable access logging to a file named /var/log/nginx/access.log with the default format?

easy

A. access_log /var/log/nginx/access.log off;

B. access_log /var/log/nginx/access.log default;

C. access_log /var/log/nginx/access.log main;

D. access_log /var/log/nginx/access.log;

Solution

1. Step 1: Recall default access_log syntax

   The access_log directive requires the log file path and optionally a format. If no format is given, the default is used.

2. Step 2: Analyze each option

   access_log /var/log/nginx/access.log main; uses 'main' which is predefined but different from the default 'combined'; access_log /var/log/nginx/access.log default; uses 'default' which is not a valid format name; access_log /var/log/nginx/access.log; correctly specifies only the file path, using default format implicitly; access_log /var/log/nginx/access.log off; disables logging with 'off'.

3. Final Answer:

   access_log /var/log/nginx/access.log; -> Option D

4. Quick Check:

   Default format = omit format name [OK]

Hint: Omit format name to use default logging [OK]

Common Mistakes:

• Using invalid format names like 'default'
• Adding 'off' disables logging
• Using 'main' which is not the default format

3. Given this nginx config snippet:

access_log /var/log/nginx/access.log custom_format;
log_format custom_format '$remote_addr - $remote_user [$time_local] "$request" $status';

What will be logged for a request from IP 192.168.1.10 with user 'john' requesting GET /home and status 200?

medium

A. john - 192.168.1.10 [time] "GET /home" 200

B. 192.168.1.10 - john [time] "GET /home" 200

C. 192.168.1.10 - - [time] "GET /home" 200

D. 192.168.1.10 john [time] GET /home 200

Solution

1. Step 1: Understand the log_format string

   The format is: $remote_addr - $remote_user [$time_local] "$request" $status. This means IP, dash, username, time, request in quotes, and status code.

2. Step 2: Substitute values from the request

   IP is 192.168.1.10, user is 'john', request is 'GET /home', status is 200. Time is shown as [time] placeholder.

3. Final Answer:

   192.168.1.10 - john [time] "GET /home" 200 -> Option B

4. Quick Check:

   Format matches IP - user [time] "request" status [OK]

Hint: Match variables exactly as in log_format string [OK]

Common Mistakes:

• Mixing order of IP and user
• Omitting dashes or quotes
• Confusing $remote_user with $remote_addr

4. You configured access_log /var/log/nginx/access.log combined; but no logs appear. What is the most likely error?

medium

A. The 'combined' log format is not defined in nginx config

B. The log file path is incorrect

C. The access_log directive disables logging by default

D. Nginx does not support custom log formats

Solution

1. Step 1: Understand the 'combined' format usage

   'combined' is a common log format but must be defined with log_format directive in nginx config before use.

2. Step 2: Analyze why logs don't appear

   If 'combined' is not defined, nginx ignores the logging directive or fails silently, so no logs are written.

3. Final Answer:

   The 'combined' log format is not defined in nginx config -> Option A

4. Quick Check:

   Undefined format = no logs [OK]

Hint: Define custom formats before using them in access_log [OK]

Common Mistakes:

• Assuming 'combined' is built-in by default
• Ignoring file permission issues
• Thinking access_log disables logging by default

5. You want to log only requests with status code 400 or higher to /var/log/nginx/error_access.log and all requests to the default access log. Which configuration snippet achieves this?

hard

A. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status > 399;

B. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status >= 400;

C. map $status $log_error { ~^[4-9] 1; default 0; }
access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$log_error;

D. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status eq 400;

Solution

1. Step 1: Understand conditional logging in nginx

   nginx supports conditional logging using the if= parameter with variables and expressions.

2. Step 2: Use a map to create a variable for status >= 400

   Direct comparisons like '$status >= 400' are not supported in if=. Instead, a map is used to set a variable $log_error to 1 for status codes 400 and above.

3. Step 3: Apply conditional logging using the variable

   Use if=$log_error in the access_log directive to log only those requests.

4. Final Answer:

   map $status $log_error { ~^[4-9] 1; default 0; } access_log /var/log/nginx/access.log; access_log /var/log/nginx/error_access.log combined if=$log_error; -> Option C

5. Quick Check:

   Conditional logging requires map + if= variable [OK]

Hint: Use map to create condition variable for logging [OK]

Common Mistakes:

• Trying to use direct comparison in if= condition
• Not defining a map for conditional logging
• Expecting nginx to parse expressions in if= directly