/
Nginx: log inspection

Nginx: log inspection

Owned by Alessandro Rovetto
yesterday at 16:12
1 min read

Nginx

Format

It logs all the incoming http requests. It uses a fixed format:

nginx | 10.10.10.10 - - [27/Feb/2025:15:44:57 +0000] "POST /imchannel/agm/message HTTP/1.1" 200 28 "-" "java/socket" "-"

It shows the:

  • modulename

  • timestamp ( check the timezone)

  • the request method (GET, POST, OPTIONS)

  • url

  • status code (200 OK, 404 Not Found, 503 Service Unavailable etc)

  • response length

  • Referer (the main page requesting the URL)

  • User-Agent

  • x_forwarded_for

Use cases

Check if messages are incoming from social channels: Looks for /imchannel or /ctlivesocial

Check for not 200 status codes

docker compose logs nginx | grep -v " 200 " | grep -v " 304 " | grep -v " 101 "

Error messages

Besides the access log, nginx reports also internal errors like the following

nginx | 2025/02/27 14:13:38 [error] 19#19: *4519 connect() failed (111: Connection refused) while connecting to upstream, client: 10.10.10.10, server: , request: "GET /livechat/socket.io/?EIO=4&transport=polling&t=fd6wt5m8 HTTP/1.1", upstream: "http://10.10.0.10:3009/livechat/socket.io/?EIO=4&transport=polling&t=fd6wt5m8", host: "ctlive", referrer: "http://ctlive:17002/"

It reports that nginx is not able to proxy the request to the internal service (upstream) for a connection refused error.