How To Configure Logging and Log Rotation in Nginx on an Ubuntu 22 and Debian 12

Mayur Chavhan July 14, 2023 Nginx

Nginx is a popular web server used to serve web applications. It is known for its high performance, reliability, and scalability. Nginx logs all the requests that are processed by the server. These logs can be useful for troubleshooting issues with the server, analyzing traffic patterns, and monitoring server activity. However, if the logs are not properly configured and rotated, they can consume too much disk space and make it difficult to analyze the logs over time. In this guide, we will show you how to configure logging and log rotation in Nginx on an Ubuntu 22 and Debian Server 12.

Step 1: Configuring Nginx Logging

Nginx logs all the requests that are processed by the server. By default, Nginx logs all the requests to the error log file. However, it is recommended to configure separate access and error log files to make it easier to analyze the logs.

Open the Nginx configuration file /etc/nginx/nginx.conf using a text editor. You can use any text editor of your choice, such as nano, vim, or emacs.
```
sudo nano /etc/nginx/nginx.conf
```
Locate the http block in the configuration file. This block contains the main configuration for the HTTP server.
Add the following lines to the http block to enable logging: This will create two log files: /var/log/nginx/access.log for all access logs and /var/log/nginx/error.log for all error logs.
```
access_log  /var/log/nginx/access.log;
error_log  /var/log/nginx/error.log;
```
Save the changes and exit the text editor.
Restart Nginx to apply the changes:
```
sudo systemctl restart nginx
```

Step 2: Configuring Log Rotation

Log rotation is the process of archiving old log files and creating new ones to prevent disk space issues. In Nginx, log rotation can be configured using the logrotate utility. The logrotate utility is a system tool that can be used to manage log files.

Create a new log rotation configuration file for Nginx:
```
sudo nano /etc/logrotate.d/nginx
```
Add the following lines to the file: This configuration will rotate the logs daily, keep 52 rotated logs, compress the rotated logs, delay compression until the next rotation, and create new log files with permissions 0640 owned by the www-data and adm groups.
```
/var/log/nginx/*.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /run/nginx.pid ] && kill -USR1 `cat /run/nginx.pid`
    endscript
}
```
Save the changes and exit the text editor.
Test the log rotation configuration: This command will force a log rotation and print any errors to the console.
```
sudo logrotate -f /etc/logrotate.d/nginx
```

Tips and Tricks

Real-time Nginx logs

To view the Nginx logs in real-time, use the tail command:

tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

The tail command will display the last few lines of the log file and wait for new lines to be added to the file. This is useful for monitoring the logs in real-time.

Analyzing Nginx logs

To analyze the Nginx logs, use a log analyzer like goaccess. goaccess is a command-line tool that can be used to generate reports from log files. goaccess can generate reports in HTML, JSON, or CSV format.

To install goaccess on Ubuntu 22 or Debian Server 12, run the following command:

sudo apt install goaccess

To generate an HTML report from the access log, run the following command:

goaccess /var/log/nginx/access.log -o /var/www/html/report.html --log-format=COMBINED

This command will generate an HTML report from the access log and save it to /var/www/html/report.html.

Excluding specific requests from being logged

To exclude specific requests from being logged, use the map directive in the Nginx configuration file. The map directive can be used to define a variable that can be used in the configuration file.

For example, to exclude requests that match the regular expression ~*^/admin from being logged, add the following configuration to the Nginx configuration file:

map $request_uri $loggable {
    default 1;
    ~*^/admin 0;
}
server {
    ...
    access_log  /var/log/nginx/access.log combined if=$loggable;
    ...
}

This configuration will exclude requests that match the regular expression ~*^/admin from being logged.

Customizing log formats

By default, Nginx uses the combined log format, which includes the client IP address, request time, request method, request URL, HTTP version, status code, size of the response, referrer, and user agent. However, you can customize the log format to include only the information that you need.

To customize the log format, modify the access_log directive in the Nginx configuration file. For example, to include only the client IP address, request time, request URL, and user agent, add the following line to the http block in the Nginx configuration file:

log_format  mylog  '$remote_addr - $time_local - "$request" - "$http_user_agent"';

Then, update the access_log directive to use the new log format:

access_log  /var/log/nginx/access.log mylog;

This will create a log file at /var/log/nginx/access.log using the mylog log format.

Conclusion

In this guide, we have shown you how to configure logging and log rotation in Nginx on an Ubuntu 22 and Debian Server 12. By following these steps, you can ensure that your Nginx logs are properly configured and rotated to prevent disk space issues and make it easier to analyze the logs when troubleshooting issues. We have also provided some tips and tricks to help you monitor and analyze the logs, customize log formats, and exclude specific requests from being logged.