In Linux, Nginx logs are regularly cut and logs generated several days ago are deleted.

In Linux, Nginx logs are regularly cut and logs generated several days ago are deleted.

Nginx logs are classified into access logs. log and error. log, where access. log records users, pages, user browsers, ip addresses, and other access information. error. log records server error logs.

The error. log format is as follows:
201.158.69.116--[03/Jan/2013: 21: 17: 20-0600] fwf [-] tip [-] 127.0.0.1: 9000 0.007 MX pythontab.com GET/html/test.html HTTP/0.007 "1.1" 200 "http://a.com" "es-ES, es; q = 2426" "Mozilla/0.8 (Windows NT 5.0) appleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.20.1.97 Safari/537.11"
187.171.69.177--[03/Jan/2013: 21: 17: 20-0600] fwf [-] tip [-] 127.0.0.1: 9000 0.006 MX pythontab.com GET/html/test2.html HTTP/0.006 "1.1" 200 "http://a.com" "es-ES, es; q = 2426" "Mozilla/0.8 (Windows NT 5.0) appleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.20.1.97 Safari/537.11"

We can see some information from the above:

1. Client (User) ip address. For example, in the previous example, 201.158.69.116

2. Access time. For example, [03/Jan/2013: 21: 17: 20-0600]

3. access port. For example, 127.0.0.1: 9000 in the above example

4. response time. For example, in the above example, 0.007

5. Request time. For example, in the above example, 0.007

6. User geographic location code (country code ). For example, MX (Mexico) in the above example)

7. host of the requested url address (target url address. For example, pythontab.com in the above example

8. Request Method (GET or POST ). For example, GET in the previous example

9. request url (remove the host part ). For example,/html/test.html in the above example

10. Request status (status code, 200 indicates success, 404 indicates that the page does not exist, 301 indicates permanent redirection, etc. The specific status code can be found online and will not be repeated ). For example, in the above example, "200"

11. Request page size. The default value is B (byte ). For example, in the above example, 2426

12. Source Page, that is, from which page to which the professional name is "referer ". For example: the "http://a.com" in the above example"

13. user browser language. For example, in the above example, "es-ES, es; q = 0.8"

14. Other information about the user's browser, such as the browser version and browser type. For example, in the above example, "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/53 7.11 (KHTML, like Gecko) Chrome/23.0.20.1.97 Safari/537.11"

The format of access. log logs is not static and can be customized. In the nginx. conf configuration file of nginx, find log_format, which is the log format.
# Log_format main '$ remote_addr-$ remote_user [$ time_local] "$ request "'
# '$ Status $ body_bytes_sent "$ http_referer "'
# '"$ Http_user_agent" "$ http_x_forwarded_for "';

# Access_log logs/access. log main;

Log_format is the Nginx HttpLog module command used to specify the output format of Nginx logs. Main is the name of the log output format, which can be referenced in the following access_log command.

Eg:
192.168.21.1--[27/Jan/2014: 11: 28: 53 + 0800] "GET/2.php HTTP/1.1" 200 133 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1707.0 Safari/537.36 "-" 192.168.21.128 200 127.0.0.1: 9000 0.119 0.119

$ Remote_addr: client address 192.168.21.1

$ Remote_user: client user-

$ Time_local: Time and time zone 27/Jan/2014: 11: 28: 53 + 0800

$ Request: request URL path and HTTP protocol GET/2.php HTTP/1.1

$ Status: HTTP status 200

$ Body_bytes_sent: the size of the page sent to the client is 133

$ Http_referer: page Jump source-

$ Http_user_agent: User Access Terminal Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1707.0 Safari/537.36

$ Http_x_forwarded_for: The real IP address of the requester in the HTTP Proxy-

$ Http_host: the URL (IP address or domain name) entered by the user in the browser 192.168.21.128

$ Upstream_status: upstream status 200

$ Upstream_addr: the backend upstream address and port 127.0.0.1: 9000

$ Request_time: total page access time 0.119

$ Upstream_response_time: the response time of upstream in page access is 0.119

If an intermediate layer (such as reverse proxy server) is added between the client and the Web server, the Web server cannot directly obtain the lP of the client, the IP address obtained through the $ remote_addr variable is the IP address of the reverse proxy server. However, the reverse proxy server can add X-Forwarded-For information in the HTTP header of the Forwarded request to record the lP address of the original client and the server address requested by the original client.

At this time, you need to use the log_format command to set the log format, so that the log records the lP address in the X-Forwarded-For information, that is, the customer's real IP address. For example, create a log format named mylogformat and record your X-Forwarded-For lP address with the $ http_x_forwarded_for variable:
Log_format mylogformat '$ http_x_forwarded_for-$ remote_user [$ time_local] "$ request "'
'$ Status $ body_bytes_sent "$ http_referer "'
'"$ Http_user_agent" "$ http_x_forwarded_for "';

To disable logging, run the following command:
Access_log off

Nginx Log File Cutting

In the production environment, due to the fast growth of access log files, too many logs seriously affect server efficiency. In addition, to facilitate Log Analysis and Computation, you must regularly cut log files. Regular cutting includes monthly cutting, daily cutting, and hourly cutting. The most common method is daily cutting.
Nginx does not support using cronolog to rotate logs like Apache, but you can use the following methods to cut log files:
Mv/usr/local/nginx/logs/access. log/usr/local/nginx/logs/access_20150519084513.log
Kill-USR1 Nginx master process number
Use the mv command to rename the log file to/usr/local/nginx/logs/access_20150519084513.log, and then send the kill-USR1 signal to the main process Number of Nginx, let Nginx regenerate a new log file/usr/local/nginx/logs/access. log.
To regularly cut logs every day, you also need to use crontab. We can write a shell script that stores logs by day and by year or month:
[Root @ localhost logs] # vim/usr/local/nginx/sbin/cut_nginx_log.sh

#! /Bin/bash
Logs_path = "/usr/local/nginx/logs /"
DAYS = 30
Mv $ {logs_path} access. log $ {logs_path} access _ $ (date-d "yesterday" + "% Y % m % d % H % M % S"). log
# Mv $ {logs_path} access. log $ {logs_path} access _ $ (date + "% Y year % m month % d day % H % M minute % S second week % w "). log
Kill-USR1 'cat/usr/local/nginx/logs/nginx. pid'
Find $ {logs_path}-name "access _ *. log"-type f-mtime + $ DAYS-exec rm {}\;
[Root @ localhost logs] # chmod + x/usr/local/nginx/sbin/cut_nginx_log.sh
[Root @ localhost logs] # crontab-e
0 0 ***/usr/local/nginx/sbin/cut_nginx_log.sh
[Root @ localhost logs] # service crond restart
Stopping crond: [OK]
Starting crond: [OK]
[Root @ localhost logs] # chkconfig crond on
[Root @ localhost logs] #

If the following error occurs during the script execution
Nginx: [error] open () "/usr/local/nginx/logs/nginx. pid" failed

Solution:
[Root @ localhost logs] #/usr/local/nginx/sbin/nginx-c/usr/local/nginx/conf/nginx. conf

For more Nginx tutorials, see the following:

Deployment of Nginx + MySQL + PHP in CentOS 6.2

Build a WEB server using Nginx

Build a Web server based on Linux6.3 + Nginx1.2 + PHP5 + MySQL5.5

Performance Tuning for Nginx in CentOS 6.3

Configure Nginx to load the ngx_pagespeed module in CentOS 6.3

Install and configure Nginx + Pcre + php-fpm in CentOS 6.4

Nginx installation and configuration instructions

Nginx log filtering using ngx_log_if does not record specific logs

Nginx details: click here
Nginx: click here

This article permanently updates the link address: