How does Nginx logging work with access logs and error logs?
Understand how Nginx logging works: what access logs and error logs record, custom log_format fields, severity levels, and safe log rotation.
Expected Interview Answer
Nginx keeps two separate logs: the access log records every request that Nginx serves (who asked for what, and the response), while the error log records diagnostic messages about problems and Nginx's own operation at a configurable severity level.
The access log is controlled by the access_log directive and formatted by log_format, letting you capture fields like remote address, request line, status, bytes sent, referrer, and user agent. The error log is controlled by the error_log directive with a level such as warn, error, or debug, and captures startup issues, upstream failures, and configuration warnings. Both can be set globally or per server/location, disabled with 'off', and rotated with logrotate plus a reload or reopen signal so Nginx writes to fresh files.
- Separates traffic auditing from problem diagnosis
- Customisable access log fields via log_format
- Severity levels control error log verbosity
- Per-server and per-location log control
- Supports rotation to manage disk usage
AI Mentor Explanation
Think of two record books at a match. The access log is the ball-by-ball scorebook, noting every delivery, who faced it, and the outcome — a complete history of play. The error log is the umpire's incident notebook, written only when something goes wrong: a disputed catch, a broken bail, a light-stoppage. One captures every event routinely; the other captures faults with a note of how serious each was.
Step-by-Step Explanation
Step 1
Understand the two logs
access_log records served requests; error_log records diagnostics and problems at a severity level.
Step 2
Define a log format
Use log_format to name a format capturing fields like $remote_addr, $request, $status, and $http_user_agent.
Step 3
Set access_log
Point access_log to a file and format, e.g. access_log /var/log/nginx/access.log main; or 'off' to disable.
Step 4
Set error_log with a level
Use error_log /var/log/nginx/error.log warn; choose warn, error, or debug depending on how much detail you need.
Step 5
Rotate the logs
Use logrotate, then send a reopen signal (nginx -s reopen) so Nginx writes to the fresh files.
What Interviewer Expects
- Knows access log records requests, error log records problems
- Understands log_format and custom fields
- Knows error_log severity levels
- Aware logs can be set per server or location
- Mentions log rotation and the reopen signal
Common Mistakes
- Confusing the access log with the error log
- Not knowing error_log takes a severity level
- Forgetting logs can be scoped per server or location
- Leaving debug level on in production, bloating disk
- Rotating files without reopening, so Nginx keeps writing to the old file
Best Answer (HR Friendly)
“Nginx keeps two logs: an access log that records every request it serves, like a visitor sign-in sheet, and an error log that records problems and warnings. You can customise what the access log captures and choose how detailed the error log is.”
Code Example
http {
# Define a custom access log format
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
# Global logs
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log warn;
server {
server_name example.com;
# Per-location override
location /health {
access_log off; # skip noisy health checks
}
}
}Follow-up Questions
- What variables can you include in a custom log_format?
- What are the severity levels for error_log?
- How do you disable the access log for specific requests?
- How do you rotate Nginx logs without losing entries?
- Can you send Nginx logs to syslog instead of a file?
MCQ Practice
1. Which Nginx log records every request that is served?
The access log, controlled by access_log, records each served request; the error log records diagnostics.
2. Which directive controls the verbosity of diagnostic messages?
error_log takes a severity level such as warn, error, or debug to control how much detail is logged.
3. After rotating log files with logrotate, what must Nginx do?
Sending nginx -s reopen makes Nginx write to the newly created files instead of the rotated ones.
Flash Cards
What does the access log record? — Every request Nginx serves — client address, request line, status, bytes, referrer, user agent.
What does the error log record? — Diagnostic messages and problems at a severity level like warn, error, or debug.
How do you customise access log fields? — Define a log_format with variables and reference it in the access_log directive.
How do you rotate Nginx logs safely? — Use logrotate, then nginx -s reopen so Nginx writes to the fresh files.