NGINX: access logs – log all except 200 responses

The task is to save to a log file all requests excluding ones with the 200 response from the NGINX.

Using the approach described below with the map you can do various things, for example – chose a location to be used based on a header value. Will add such an example later.

For now, we are interested in two NGINX abilities: the conditional logging to choose when need to save an event to a log file and the map to set a variable’s value based on other variables.

map

Add the $abnormal variable in the http {} block and set its value to 0 – if a response has 200 value or default value 1 – if not:

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    map $status $abnormal {
        ~^200  0;
        default 1;
    }
    ...

Conditional logging

Next, in the server {} set condition to be used for the access.log using the if condition: if the $abnormal variable’s value is zero – then log nothing, if 1 – to save this response to the log:

server {
    charset utf-8;
    listen 80 default_server;
    server_name stage.example.com;
    if ($http_x_forwarded_proto = 'http') {
        return 301 https://stage.example.com$request_uri;
    }
    set $root_path /data/projects/frontend/web;
    root $root_path;
    index index.php;
    error_log /var/log/nginx/stage.example.com-error.log;
    access_log /var/log/nginx/stage.example.com-access.log combined if=$abnormal;
...

Check it:

127.0.0.1 - - [15/Mar/2019:14:51:37 +0200] "GET /nginx_status HTTP/1.1" 404 153 "-" "Go-http-client/1.1"

127.0.0.1 - - [15/Mar/2019:14:51:52 +0200] "GET /nginx_status HTTP/1.1" 404 153 "-" "Go-http-client/1.1"

Done.

Similar posts

• 04/12/2017 NGINX: динамический upstream (0)
• 03/23/2017 NGINX: бан User Agent (0)
• 03/17/2019 NextCloud: installing server on Debian behind NGINX with PHP-FPM and client on Arch Linux (0)
• 09/20/2018 NGINX: gzip и ETag weak validation (0)

Comments

[Dan]

This is aweseome, so you can reduce log data to a minimum. Thanks for this, Arseny.

I've added status 304 ("Not Modified") to avoid writing unnecessary logs:

~^(200|304) 0;

[Arseny Zinchenko]

Happy it was useful for you, Dan :-)

And thanks for your example with 304 - I also had added ^3 alongside with ^401 (yeah, we are dropping 401).

[Joanlowers]

To get access log all except 200 responses. These responses are important at the time when we are showing papersowl. In that time we just collect all that which is important in more of the time.