Log Formatting

This page contains information on nginx’s log formatting as well as some pointers on how to transform Apache HTTP Server (httpd) custom log formats to nginx log formats.

Another interesting resource is the nginx admin guide: logging and monitoring.

Error Log

The error log of nginx is built-in and its format cannot be customized in the user’s configuration. This differs from httpd where users are able to customize the format via the ErrorLogFormat directive. The reason for this is not documented, however, all log entries have a few things in common:

$time [$level] $pid#$tid: *$cid $formatted_message

Each log entry starts with a date and time ($time) in the format Y/m/d h:m:s followed by one of the error log severity levels ($level) in square brackets which follow the syslog standard (RFC 5424). The lowest level (debug) is only available if nginx was built with the --debug option enabled. More information is available at the debugging log documentation page.

The $pid is the process identifier and the $tid the thread identifier of the instance that logged the message. It is followed by the $cid which is the global connection counter value.

The $formatted_message is free text that the nginx developer enter in the call to ngx_log_error. These messages are usually not parsed and should be simply logged as is.

Access Log

The access log, in contrast to the error log, can be customized. The very common combined log format is already predefined an built-in and it is the default format for all of nginx’s access log entries.

$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"

Note that nginx has no support for IDENT (RFC 1413) and always uses - directly. IDENT is considered legacy and httpd defaults to not using it by default as well.

Rewrite Log

The rewrite log is a special logger that is available with the ngx_http_rewrite_module module (or in debug builds with the debug log level active). All rewrites are written to the error log on severity level notice if activated. There is no ability to redirect the log entries to a dedicated file other than setting up a dedicated error log for severity level notice, which of course contains any message of that level afterwards. However, there are not many of those entries in a default nginx build.

Format

Logging of these entries happens in ngx_http_script.c. All possible log entries are described in the next sections. The variables in the examples correspond to the embedded variables of nginx or were explained in one of the previous sections of this document. All other variables are prefixed with an underscore and will be explained.

Regular Expression Matches

Will be logged in the following format:^ref

$time [$level] $pid#$tid *$cid "$_regex" matches "$uri", client: $remote_addr, server: $server_name, request: "$request", host: "$host"

The $_regex variable contains the regular expression from a location block that actually matched the requested URI which is stored in $uri.

Rewritten Redirects

Will be logged in the following format:^ref

$time [$level] $pid#$tid *$cid rewritten redirect: "$uri", client: $remote_addr, server: $server_name, request: "$request", host: "$host"

Rewritten Data

Rewritten data refers to rewrite directives that are encountered inline, e.g.:

location ~ ^/hello-world {
    rewrite ^(/hello-)world(.*) $1foo$2 last;
}

They will be logged in the following format:^ref/sup>

$time [$level] $pid#$tid *$cid rewritten data: "$uri", args: "$args", client: $remote_addr, server: $server_name, request: "$request", host: "$host"

httpd to nginx

httpdref	nginxref	Comment
%a	$remote_addr
%{c}a	?
%A	$server_addr
%B	$body_bytes_sent
%b	—	Not available.
%{VARNAME}C	?
%D	$request_time
%{VARNAME}e	—	Environment variables are not accessible via default nginx.
%f	?
%h	$remote_addr	Best available equivalent.
%H	?
%{VARNAME}i	$http_*
%k	?
%l	—	Not available.
%L	?
%m	?
%{VARNAME}n	—	Directly available under the variable’s name, e.g. set $name 'value'; is available as $name.
%{VARNAME}o	?
%p	?
%{format}p	?
%P	?
%{format}P	?
%q	?
%r	$request
%R	?
%s	$status
%>s	$status
%t	$time_local
%{format}t	?
%{msec}t	$msec
%T	?
%{UNIT}T	?
%u	$remote_user
%U	?
%v	$server_name
%V	$server_name
%X	?
%{VARNAME}^ti	?
%{VARNAME}^to	?

httpdref	nginx	Comment
%I	$request_length
%O	$bytes_sent
%S	?
%^FB	?

There are other special variables that are only available together with certain modules:

• $realip_remote_addr