Configuring the Nginx Error Log and Access Log

Logs are a very useful aspect of web server administration and web development as they provide useful debugging information and allow you to analyze other aspects of your web server. This article will go through the process of configuring both your Nginx error log and access log files as well as display a few ways to read each file directly from the terminal.

What is an Nginx error log?

Nginx error logs are used to log general error messages. If you experience an error in your web application, it is always good practice to check the Nginx error log file to see if there is any additional information as to why the error occurred. The error_log directive can be defined in your nginx.conf file. The directive will be in the following format and can be specified within an http, server, or location block:

error_log log_file log_level

The error_log portion defines the directive, the log_file portion defines the absolute path of your log file, and the log_level portion defines the severity level for which you want error messages to be logged. Therefore, an example of what the directive looks like when each portion is populated will resemble:

error_log /var/log/nginx/error.log warn;

When defining the severity level, Nginx will log all errors that are equal to or above the defined level.

Nginx error log severity levels

The are various severity levels that can be defined in the error_log directive. The following is a list of all severity levels (from low to high) you may use along with a short description of each.

• debug - Useful debugging information to help determine where the problem lies.
• info - Informational messages that aren't necessary to read but may be good to know.
• notice - Something normal happened that is worth noting.
• warn - Something unexpected happened, however is not a cause for concern.
• error - Something was unsuccessful.
• crit - There are problems that need to be critically addressed.
• alert - Prompt action is required.
• emerg - The system is in an unusable state and requires immediate attention.

As mentioned above, once you define the severity level in the error_log directive, Nginx will include all errors corresponding to said severity level as well as everything higher. For instance, in the example above we defined the severity level as warn. Therefore, Nginx would include all warn, error, crit, alert, and emerg errors in the error log.

What is an Nginx access log?

The Nginx access log is similar to the error log in that it logs information, however the type of information that it logs is what differentiates it. Nginx writes information in the access log regarding each request made by a client. The access_log directive uses the following syntax:

access_log log_file log_format;

The access_log portion defines the directive, the log_file portion defines the location of the access.log file, the log_format portion can be defined using variables (default format is combined). Read the Nginx logging and monitoring article for more information regarding log_format. The following shows an example of what the combined log_format looks like:

log_format combined '$remote_addr - $remote_user [$time_local]'
    '"$request" $status $body_bytes_sent '
    '"$http_referer" "$http_user_agent"';

Therefore, when defining each portion of the access log directive, it may resemble the following:

access_log /var/log/nginx/access.log log_file combined;

Parsing logs examples

There are various ways you can use to display or parse the error/access logs. Using the cat command will display the complete access or error log file in your terminal window. For example you could use the following to display the contents of each file:

• cat /var/log/nginx/error.log
• cat /var/log/nginx/access.log

Alternatively, you could use the tail -f command to display the 10 most recent lines of the file and monitor the file for any additional changes.

• tail -f /var/log/nginx/error.log
• tail -f /var/log/nginx/access.log

Additionally, you may use an awk command to display the number of responses that returned a particular status code. For example:

awk '{print $9}' access.log | sort | uniq -c | sort -rn

36461 200
483 500
87 404
9 400
3 302
1 499
1 403
1 301

We can then display the URLs which are returning a particular status code.

awk '($9 ~ /302/)' access.log | awk '{print $7}' | sort | uniq -c | sort -rn

1 /wp-login.php
1 /wp-admin/plugins.php?action=activate&plugin=foobar.php&_wpnonce=cc4a379131
1 /wp-admin/

Checking your web server's logs is a great way to help debug a particular problem or analyze a particular pattern. As shown above, this can be one manually however you can also use tools such as GoAccess to also monitor and analyze your Nginx logs.

Now that you have more information regarding what the Nginx error log and access logs are for, try using them the next time you need certain information regarding your web server.