Updated on 2025-03-28 GMT+08:00

Nginx Logs

Nginx is an open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3/SMTP proxy server. It features stability, extensive functions, easy-to-use configuration, and low system resource consumption. Nginx is often used to process static files, load balancing, reverse proxy, and cache. It is applicable to websites and applications of various scales.

Nginx logs are classified into two types: access_log (access log) and error_log (error log). They are useful for system monitoring, performance analysis, and troubleshooting.

  • access_log (access log): Records detailed information about client access to an Nginx server. Access logs help you learn about the IP address, accessed URL, access time, request processing time, HTTP response status code, and request header.
  • error_log (error log): records the errors and warnings encountered by the Nginx server during request processing. You can check the error logs to locate the source of a fault and rectify the fault.

Collection Method

Install ICAgent and configure ECS text log ingestion by referring to Installing ICAgent (Intra-Region Hosts) and Ingesting ECS Text Logs to LTS. Then, ICAgent will collect ECS text logs and report them to LTS.

Nginx Log Examples and Fields

This section describes the examples and fields of access logs and error logs.

Table 1 Access log fields

Parameter

Description

Example

$remote_addr

Client IP address

211.28.65.253

$remote_user

Client username

--

$time_local

Access time and time zone

18/Jul/2012:17:00:01 +0800

$request

Request URL and HTTP protocol

"GET /article-10000.html HTTP/1.1"

$http_host

Request address, that is, the address (IP address or domain name) entered in the browser

www.wang.com 192.168.100.100

$status

HTTP request status

200

$upstream_status

Upstream status

200

$body_bytes_sent

Size of the file sent to the client

1547

$http_referer

Source page URL

https://www.example.com/

$http_user_agent

Client browser information

"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; GTB7.0; .NET4.0C;

$ssl_protocol

SSL version

TLSv1

$ssl_cipher

Algorithm for exchanging data

RC4-SHA

$upstream_addr

Address of the upstream server, that is, the address of the host that actually provides services

10.10.10.100:80

$request_time

Total request time

0.205

$upstream_response_time

Response time of upstream during the request process

0.002

Error log example:

2023/07/10 17:00:00 [error] 12345#12345: *1 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.1.100, server: example.com, request: "GET /api/data HTTP/1.1", upstream: "http://10.0.0.1:8080", host: "example.com
Table 2 Error log fields

Example

Description

2023/07/10 17:00:00

Time when an error occurred

[error]

Error log

12345#12345

Process ID

*1

Connection ID

recv() failed (104: Connection reset by peer) while reading response header from upstream

Error information, indicating that the response header fails to be received when it is read from the upstream system. The error cause is that the connection is reset by the peer end.

client: 192.168.1.100

IP address of the client

server: example.com

Server name

request: "GET /api/data HTTP/1.1"

Request method and path

upstream: "http://x.x.x.x:8080"

Address of the upstream server

host: "example.com"

Requested host name

Log Location

You can use commands in the Nginx configuration file to set the storage location and format of access logs and error logs. Example:

http {  
    ...  
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '  
                      '$status $body_bytes_sent "$http_referer" '  
                      '"$http_user_agent" "$http_x_forwarded_for"';  

    server {  
        ...  
        access_log  /var/log/nginx/access.log  main;  
        error_log  /var/log/nginx/error.log warn;
        ...  
    }  
}

In this example, the log_format parameter defines a log format named main, the access_log parameter in the server block specifies the location /var/log/nginx/access.log for storing access logs, error_log specifies /var/log/nginx/error.log for storing error logs, and the log level is set to warn. Nginx supports multiple log levels, including debug, info, notice, warn, error, crit, and alert.