Logging

# Watch logs live
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

# Filter by status code
tail -f /var/log/nginx/access.log | grep '" 5'

# Count requests by IP
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

access_log path [format [buffer=size [flush=time]] [if=condition]];

# Examples
access_log /var/log/nginx/example.access.log combined;
access_log /var/log/nginx/example.access.log main buffer=32k flush=5s;
access_log off;   # Disable entirely for this block

error_log path [level];

# Level (lowest to most verbose): emerg alert crit error warn notice info debug
error_log /var/log/nginx/error.log warn;      # Production default
error_log /var/log/nginx/error.log debug;     # Full debug (very verbose)
error_log /dev/null;                          # Suppress all errors (not recommended)

# "combined" (default) — already defined in nginx.conf
log_format combined '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent"';

# "main" (defined in the stock nginx.conf, not built in) is combined
# plus "$http_x_forwarded_for" — see Custom Log Format below

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    log_format json_combined escape=json
        '{'
            '"time":"$time_iso8601",'
            '"remote_addr":"$remote_addr",'
            '"method":"$request_method",'
            '"uri":"$request_uri",'
            '"status":$status,'
            '"bytes_sent":$body_bytes_sent,'
            '"request_time":$request_time,'
            '"upstream_time":"$upstream_response_time",'
            '"upstream_addr":"$upstream_addr",'
            '"http_referrer":"$http_referer",'
            '"http_user_agent":"$http_user_agent"'
        '}';

    access_log /var/log/nginx/access.json json_combined;
}

# Silence noisy health checks
location = /health {
    access_log off;
    return 200;
}

# Log static assets to a separate file
location ~* \.(js|css|png|jpg)$ {
    access_log /var/log/nginx/static.log;
    root /var/www/app;
}

# Conditional logging — skip 2xx responses from monitoring IPs
map $status $log_this {
    ~^2  0;
    default 1;
}
access_log /var/log/nginx/errors.log combined if=$log_this;

# Only log errors
map $status $is_error {
    ~^[45] 1;
    default 0;
}

access_log /var/log/nginx/errors.log combined if=$is_error;

# /etc/logrotate.d/nginx  (installed by package, shown for reference)
/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 640 nginx adm
    sharedscripts
    postrotate
        # Send USR1 to reopen log files without restarting
        nginx -s reopen
    endscript
}

# Force immediate rotation
sudo logrotate -f /etc/logrotate.d/nginx

# Manually reopen logs (zero-downtime)
sudo nginx -s reopen
# or
sudo kill -USR1 $(cat /var/run/nginx.pid)

# Buffer writes — flush every 5 s or when buffer is full
access_log /var/log/nginx/access.log combined buffer=64k flush=5s;