Master Nginx Log Formatting: Customize Access Logs for Precise Debugging

Preface

In Nginx, log output can be easily controlled using the HttpLogModule.

HttpLogModule

2.1 Example

2.2 Directives

Directive access_log syntax: access_log [format [buffer=size]] | off. Default: access_log logs/access.log combined;. Contexts: http, server, location, if in location, limit_except.

Directive log_format syntax: log_format name [escape=default|json|none] string ...;. Default: log_format combined "...";. Context: http.

Directive open_log_file_cache syntax:

open_log_file_cache max=N [inactive=time] [min_uses=N] [valid=time]; | open_log_file_cache off;

. Default: off. Contexts: http, server, location.

Options: max – maximum number of file descriptors stored in the cache (LRU eviction). inactive – time interval after which unused descriptors are removed (default 10s). min_uses – minimum accesses within a period before caching (default 1). valid – time to check existence of same‑named file (default 60s). off – disables the cache.

Example:

open_log_file_cache max=1000 inactive=20s min_uses=2 valid=1m;

2.3 Test

View the default log format:

Test a request and view the generated log:

Note the two “-” placeholders: the first comes from the log_format, the second appears when $remote_user is null.

Custom log formats can be defined, for example:

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for" "$request_time";'

log_format remote_main '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for" "$request_time" '
                       '"$upstream_response_time" "$upstream_addr" "$upstream_status"';

It is recommended to define a separate log file per location instead of a global http log, which helps quickly locate anomalies.

Example configuration:

access_log /var/log/nginx/xxx.log buffer=32k flush=5s;

When a buffer is set, logs are written to disk only when the buffer reaches 32 KB or after 5 seconds, whichever comes first.

Remember to enable log caching to reduce server resource consumption.

2.4 Test

Run curl http://10.0.10.158/ and examine the log:

The final field $request_time shows the total request duration; in the test it was 0.000 seconds.

Another example with curl http://10.0.10.158/apache/index.html shows a log entry where the URI, total time, backend processing time, backend socket, and status code are clearly visible.