Access log configuration in Nginx - Mini Project: Build & Apply

Access log configuration

📖 Scenario: You are managing a web server using nginx. To monitor traffic and troubleshoot issues, you need to set up access logs that record details about each visitor's request.

🎯 Goal: Configure nginx to create an access log file with a custom log format that includes the client IP, request method, requested URL, response status, and user agent.

📋 What You'll Learn

Create a custom log format named main with specific fields

Set the access log to use the main format and write to /var/log/nginx/access.log

Use exact directive names and syntax for log_format and access_log

Ensure the configuration is valid for nginx

💡 Why This Matters

🌍 Real World

Web servers use access logs to record details about every visitor's request. This helps in analyzing traffic, detecting attacks, and debugging problems.

💼 Career

DevOps engineers and system administrators often configure and maintain web server logs to ensure reliable and secure service operation.

1

Create a custom log format

Write a log_format directive named main that logs the client IP ($remote_addr), request method ($request_method), requested URL ($request_uri), response status ($status), and user agent ($http_user_agent). Use spaces to separate the fields.

Nginx

# Your code here

Hint

Use the log_format directive with the name main and list the variables inside single quotes separated by spaces.

2

Set the access log file path

Add an access_log directive that writes logs to /var/log/nginx/access.log using the main log format.

Nginx

log_format main '$remote_addr $request_method $request_uri $status $http_user_agent';
# Your code here

Hint

Use the access_log directive with the file path and the log format name.

3

Add the configuration inside the http block

Wrap the log_format and access_log directives inside an http { } block.

Nginx

# Your code here

Hint

Use http { } to group the logging directives.

4

Display the final configuration

Print the entire http block configuration to verify the access log setup.

Nginx

# Your code here

Hint

Use a print statement to show the full http block configuration exactly as written.

Practice

1. What is the main purpose of the access_log directive in nginx?

easy

A. To record details of every request made to the server

B. To block unwanted IP addresses

C. To restart the nginx service

D. To configure server SSL certificates

Solution

1. Step 1: Understand the role of access logs

   Access logs keep track of every request made to the server, helping monitor traffic and troubleshoot issues.

2. Step 2: Identify the function of access_log

   The access_log directive in nginx specifies where and how these request details are recorded.

3. Final Answer:

   To record details of every request made to the server -> Option A

4. Quick Check:

   Access logs = record requests [OK]

Hint: Access logs always record requests, not block or restart [OK]

Common Mistakes:

• Confusing access_log with security or restart commands
• Thinking access_log blocks IPs
• Assuming access_log manages SSL

2. Which of the following is the correct syntax to enable access logging to a file named /var/log/nginx/access.log with the default format?

easy

A. access_log /var/log/nginx/access.log off;

B. access_log /var/log/nginx/access.log default;

C. access_log /var/log/nginx/access.log main;

D. access_log /var/log/nginx/access.log;

Solution

1. Step 1: Recall default access_log syntax

   The access_log directive requires the log file path and optionally a format. If no format is given, the default is used.

2. Step 2: Analyze each option

   access_log /var/log/nginx/access.log main; uses 'main' which is predefined but different from the default 'combined'; access_log /var/log/nginx/access.log default; uses 'default' which is not a valid format name; access_log /var/log/nginx/access.log; correctly specifies only the file path, using default format implicitly; access_log /var/log/nginx/access.log off; disables logging with 'off'.

3. Final Answer:

   access_log /var/log/nginx/access.log; -> Option D

4. Quick Check:

   Default format = omit format name [OK]

Hint: Omit format name to use default logging [OK]

Common Mistakes:

• Using invalid format names like 'default'
• Adding 'off' disables logging
• Using 'main' which is not the default format

3. Given this nginx config snippet:

access_log /var/log/nginx/access.log custom_format;
log_format custom_format '$remote_addr - $remote_user [$time_local] "$request" $status';

What will be logged for a request from IP 192.168.1.10 with user 'john' requesting GET /home and status 200?

medium

A. john - 192.168.1.10 [time] "GET /home" 200

B. 192.168.1.10 - john [time] "GET /home" 200

C. 192.168.1.10 - - [time] "GET /home" 200

D. 192.168.1.10 john [time] GET /home 200

Solution

1. Step 1: Understand the log_format string

   The format is: $remote_addr - $remote_user [$time_local] "$request" $status. This means IP, dash, username, time, request in quotes, and status code.

2. Step 2: Substitute values from the request

   IP is 192.168.1.10, user is 'john', request is 'GET /home', status is 200. Time is shown as [time] placeholder.

3. Final Answer:

   192.168.1.10 - john [time] "GET /home" 200 -> Option B

4. Quick Check:

   Format matches IP - user [time] "request" status [OK]

Hint: Match variables exactly as in log_format string [OK]

Common Mistakes:

• Mixing order of IP and user
• Omitting dashes or quotes
• Confusing $remote_user with $remote_addr

4. You configured access_log /var/log/nginx/access.log combined; but no logs appear. What is the most likely error?

medium

A. The 'combined' log format is not defined in nginx config

B. The log file path is incorrect

C. The access_log directive disables logging by default

D. Nginx does not support custom log formats

Solution

1. Step 1: Understand the 'combined' format usage

   'combined' is a common log format but must be defined with log_format directive in nginx config before use.

2. Step 2: Analyze why logs don't appear

   If 'combined' is not defined, nginx ignores the logging directive or fails silently, so no logs are written.

3. Final Answer:

   The 'combined' log format is not defined in nginx config -> Option A

4. Quick Check:

   Undefined format = no logs [OK]

Hint: Define custom formats before using them in access_log [OK]

Common Mistakes:

• Assuming 'combined' is built-in by default
• Ignoring file permission issues
• Thinking access_log disables logging by default

5. You want to log only requests with status code 400 or higher to /var/log/nginx/error_access.log and all requests to the default access log. Which configuration snippet achieves this?

hard

A. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status > 399;

B. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status >= 400;

C. map $status $log_error { ~^[4-9] 1; default 0; }
access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$log_error;

D. access_log /var/log/nginx/access.log;
access_log /var/log/nginx/error_access.log combined if=$status eq 400;

Solution

1. Step 1: Understand conditional logging in nginx

   nginx supports conditional logging using the if= parameter with variables and expressions.

2. Step 2: Use a map to create a variable for status >= 400

   Direct comparisons like '$status >= 400' are not supported in if=. Instead, a map is used to set a variable $log_error to 1 for status codes 400 and above.

3. Step 3: Apply conditional logging using the variable

   Use if=$log_error in the access_log directive to log only those requests.

4. Final Answer:

   map $status $log_error { ~^[4-9] 1; default 0; } access_log /var/log/nginx/access.log; access_log /var/log/nginx/error_access.log combined if=$log_error; -> Option C

5. Quick Check:

   Conditional logging requires map + if= variable [OK]

Hint: Use map to create condition variable for logging [OK]

Common Mistakes:

• Trying to use direct comparison in if= condition
• Not defining a map for conditional logging
• Expecting nginx to parse expressions in if= directly