Master Nginx Access and Error Log Configuration: Formats, Locations, and Analysis

Configure Nginx Access Log

Nginx generates a new record in the access log for each client request, capturing timestamps and various details about the client and requested resource.

The log_format directive defines the log record format, while the access_log directive enables logging, sets the log file location, and selects the format. access_log log_file log_format; Here log_file is the full path to the log file and log_format is the name of the format defined with log_format. These directives can be placed in the http, server or location context.

http {
  ...
  access_log  /var/log/nginx/access.log;
  ...
}

For better maintainability, set a separate access log for each server. A server block’s access_log overrides the global http setting.

http {
  ...
  access_log  /var/log/nginx/access.log;
  ...
  server {
    server_name domain.com;
    access_log  /var/log/nginx/domain.access.log;
    ...
  }
}

If no format is specified, Nginx uses the predefined combined format:

log_format combined '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent"';

To extend the combined format with the X-Forwarded-For header, define a new format, e.g., custom:

log_format custom '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

Use the new format by specifying its name after the log file path: access_log /var/log/nginx/access.log custom; When disk space is limited or performance is a concern, disable access logging by setting the directive to off:

access_log off;

Configure Nginx Error Log

The error_log directive enables error logging, sets the log file location, and defines the severity level. error_log log_file log_level; Log levels, from lowest to highest severity, are: debug, info, notice, warn, error, crit, alert, emerg. If omitted, the default level is error.

By default, the error log is defined in the http context of the main nginx.conf:

http {
  ...
  error_log /var/log/nginx/error.log;
  ...
}

It is recommended to set a separate error log for each server, which overrides higher‑level settings.

http {
  ...
  error_log /var/log/nginx/error.log;
  server {
    server_name domain.com;
    error_log /var/log/nginx/domain.error.log warn;
    ...
  }
}

After modifying any configuration file, reload Nginx to apply the changes.

Log File Locations

On most Linux distributions (e.g., Ubuntu, CentOS, Debian) the default directory for both access and error logs is /var/log/nginx.

Reading and Understanding Nginx Logs

Common command‑line tools such as cat, less, grep, cut, and awk can be used to view and parse log files.

192.168.33.1 - - [15/Oct/2019:19:41:46 +0000] "GET / HTTP/1" 200 396 "-" "Mozilla/0 (X11; Linux x86_64) AppleWebKit/536 (KHTML, like Gecko) Chrome/38120 Safari/536"

Field breakdown: $remote_addr – client IP address (e.g., 192.168.33.1) $remote_user – HTTP authentication user, shown as “-” if not set [$time_local] – local server time of the request "$request" – request line (method, URI, protocol) $status – HTTP response status code $body_bytes_sent – size of the response body in bytes "$http_referer" – referer URL, “-” if none "$http_user_agent" – client user‑agent string

Use tail -f access.log to watch log entries in real time.