Nginx

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. NGINX is known for its high performance, stability, rich feature set, simple configuration, and low resource consumption.

Overview

Already a Logmatic.io’s user ?

We advise you to to directly go to the Nginx - Integration on your platform that will help you do the setup and the configuration.

Stream your Nginx access logs with status codes and response times to Logmatic.io so you can:

  • Analyse the most important or simple slow URLs
  • Monitor your API calls
  • Geo locate your users
  • Understand which OS, devices and browser are using your services
  • Track errors and broken links
    -See which bots are coming and what pages are they looking (SEO monitoring)

2 options are proposed here:

Json logging is a best practice

Switch to the natively understood JSON format should always be favorited. Indeed, you sometime want to add new attributes to your format and JSON is great because totally flexible to these kind of modifications.

Setup - Stream your access log file(s) to Logmatic.io

You can now stream your log files to Logmatic.io selectively depending on your operating system:

Log shippers

Log shippers

  • If you are on Linux, use rsyslog, documentation here.
  • If you run over Microsoft Windows, use NxLog, documentationhere.

Follow the instructions and you should be able to get your log in the user interface in a couple of minutes.

A little more efforts will be rewarded!

You did the first step, however parsing extracting analytics out of them is probably what you want to do. So follow the next steps!

Setup - Switch to JSON log format

Common or combined access format

Logmatic.io is able to understand standard access log formats - common & combined thanks to the apache parsing extension that you'll need to enable.

192.0.2.1 - Ultan [25/Nov/2016:11:55:36 +0000] "GET /unencrypted_passwdsford_list?foo=bar HTTP/1.1" 404 9001 "http://passwords.hackz0r" "Mozilla/4.08 [en] (Win95)"
{
    "http": {
      "referer": "http://passwords.hackz0r",
      "request": "/unencrypted_passwdsford_list?foo=bar",
      "status_code": 404,
      "auth": "Ultan",
      "useragent": "Mozilla/4.08 [en] (Win95)",
      "verb": "GET",
      "version": "1.1",
      "request_details": {
        "path": "/unencrypted_passwdsford_list",
        "queryString": {
          "foo": "bar"
        }
      }
    },
    "network": {
      "client_ip": "192.0.2.1",
      "bytes_write": 9001
    },
    "date_access": "2016-11-25T11:55:36.000Z"
}

Change your log format to JSON

Start out by editing the nginx.conf usually found in /etc/nginx. Add the following line of configuration in the #Logging Settings section:

log_format json '{"@marker": ["nginx","access-log"],'
'"date_access": "$time_iso8601", '
'"network.client_ip": "$remote_addr", '
'"http.ident": "$host", '
'"network.bytes_write": $body_bytes_sent, '
'"http.response_time": "$request_time", '
'"http.status_code": $status, '
'"http.request": "$request_uri", '
'"http.verb": "$request_method", '
'"http.referer": "$http_referer", '
'"http.useragent": "$http_user_agent", '
'"message": "$request"}';

access_log /var/log/nginx/access.log json;
{
    "http": {
      "ident":"Ultran",
      "request": "/views/front/common/esi/user.php",
      "referer": "http://m.facebook.com/",
      "status_code": 200,
      "verb": "GET",
      "useragent": "Mozilla/5.0 (Linux; Android 6.0.1; SM-G920F Build/MMB29K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/54.0.2840.85 Mobile Safari/537.36 [FB_IAB/FB4A;FBAV/104.0.0.17.71;] ",
      "response_time": 41491,
      "version": "1.1"
    },
    "date_access": 1480067355000,
    "network": {
      "client_ip": "90.8.240.198",
      "bytes_write": 95
    }
}

Then finally restart your server:

nginx -s reload

Getting further

If you want to learn more about this topic you should consult some of our blog article:


What's next ?

Enable the http web access integration to benefit from pre-build analysis and dashboards

HTTP Web access Integration