DEV Community

loading...

NGINX: access logs – log all except 200 responses

Arseny Zinchenko
DevOps, cloud and infrastructure engineer. Love Linux, OpenSource, and AWS.
Originally published at rtfm.co.ua on ・2 min read

The task is to save to a log file all requests excluding ones with the 200 response from the NGINX.

Using the approach described below with the map you can do various things, for example – chose a location to be used based on a header value. Will add such an example later.

For now, we are interested in two NGINX abilities: the conditional logging to choose when need to save an event to a log file and the map to set a variable’s value based on other variables.

map

Add the $abnormal variable in the http {} block and set its value to 0 – if a response has 200 value or default value 1 – if not:

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    map $status $abnormal {
        ~^200  0;
        default 1;
    }
    ...

Conditional logging

Next, in the server {} set condition to be used for the access.log using the if condition: if the $abnormal variable’s value is zero – then log nothing, if 1 – to save this response to the log:

server {
    charset utf-8;
    listen 80 default_server;
    server_name stage.example.com;
    if ($http_x_forwarded_proto = 'http') {
        return 301 https://stage.example.com$request_uri;
    }
    set $root_path /data/projects/frontend/web;
    root $root_path;
    index index.php;
    error_log /var/log/nginx/stage.example.com-error.log;
    access_log /var/log/nginx/stage.example.com-access.log combined if=$abnormal;
...

Check it:

127.0.0.1 - - [15/Mar/2019:14:51:37 +0200] "GET /nginx_status HTTP/1.1" 404 153 "-" "Go-http-client/1.1"

127.0.0.1 - - [15/Mar/2019:14:51:52 +0200] "GET /nginx_status HTTP/1.1" 404 153 "-" "Go-http-client/1.1"

Done.

Similar posts

Discussion (3)

Collapse
0xd4 profile image
Dan

This is aweseome, so you can reduce log data to a minimum. Thanks for this, Arseny.

I've added status 304 ("Not Modified") to avoid writing unnecessary logs:

~^(200|304) 0;

Collapse
setevoy profile image
Arseny Zinchenko Author

Happy it was useful for you, Dan :-)

And thanks for your example with 304 - I also had added ^3 alongside with ^401 (yeah, we are dropping 401).

Collapse
joanlowers profile image
Joanlowers

To get access log all except 200 responses. These responses are important at the time when we are showing papersowl. In that time we just collect all that which is important in more of the time.