Nginx Logs

Nginx is an open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3/SMTP proxy server. It features stability, extensive functions, easy-to-use configuration, and low system resource consumption. Nginx is often used to process static files, load balancing, reverse proxy, and cache. It is applicable to websites and applications of various scales.

Nginx logs are classified into two types: access_log (access log) and error_log (error log). They are useful for system monitoring, performance analysis, and troubleshooting.

access_log (access log): Records detailed information about client access to an Nginx server. Access logs help you learn about the IP address, accessed URL, access time, request processing time, HTTP response status code, and request header.
error_log (error log): records the errors and warnings encountered by the Nginx server during request processing. You can check the error logs to locate the source of a fault and rectify the fault.

Collection Method

Install ICAgent and configure ECS text log ingestion by referring to Installing ICAgent (Intra-Region Hosts) and Ingesting ECS Text Logs to LTS. Then, ICAgent will collect ECS text logs and report them to LTS.

Nginx Log Examples and Fields

This section describes the examples and fields of access logs and error logs.

**Table 1** Access log fields
Parameter	Description	Example
$remote_addr	Client IP address	211.28.65.253
$remote_user	Client username	--
$time_local	Access time and time zone	18/Jul/2012:17:00:01 +0800
$request	Request URL and HTTP protocol	"GET /article-10000.html HTTP/1.1"
$http_host	Request address, that is, the address (IP address or domain name) entered in the browser	www.wang.com 192.168.100.100
$status	HTTP request status	200
$upstream_status	Upstream status	200
$body_bytes_sent	Size of the file sent to the client	1547
$http_referer	Source page URL	https://www.example.com/
$http_user_agent	Client browser information	"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; GTB7.0; .NET4.0C;
$ssl_protocol	SSL version	TLSv1
$ssl_cipher	Algorithm for exchanging data	RC4-SHA
$upstream_addr	Address of the upstream server, that is, the address of the host that actually provides services	10.10.10.100:80
$request_time	Total request time	0.205
$upstream_response_time	Response time of upstream during the request process	0.002

Error log example:

2023/07/10 17:00:00 [error] 12345#12345: *1 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.1.100, server: example.com, request: "GET /api/data HTTP/1.1", upstream: "http://10.0.0.1:8080", host: "example.com

**Table 2** Error log fields
Example	Description
2023/07/10 17:00:00	Time when an error occurred
[error]	Error log
12345#12345	Process ID
*1	Connection ID
recv() failed (104: Connection reset by peer) while reading response header from upstream	Error information, indicating that the response header fails to be received when it is read from the upstream system. The error cause is that the connection is reset by the peer end.
client: 192.168.1.100	IP address of the client
server: example.com	Server name
request: "GET /api/data HTTP/1.1"	Request method and path
upstream: "http://x.x.x.x:8080"	Address of the upstream server
host: "example.com"	Requested host name

Log Location

You can use commands in the Nginx configuration file to set the storage location and format of access logs and error logs. Example:

http {  
    ...  
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '  
                      '$status $body_bytes_sent "$http_referer" '  
                      '"$http_user_agent" "$http_x_forwarded_for"';  

    server {  
        ...  
        access_log  /var/log/nginx/access.log  main;  
        error_log  /var/log/nginx/error.log warn;
        ...  
    }  
}

In this example, the log_format parameter defines a log format named main, the access_log parameter in the server block specifies the location /var/log/nginx/access.log for storing access logs, error_log specifies /var/log/nginx/error.log for storing error logs, and the log level is set to warn. Nginx supports multiple log levels, including debug, info, notice, warn, error, crit, and alert.