Logging
5 answers
What gets written down, in what format, and where.
Looking for something specific
The searchable index covers all 326 answers at once and filters as you type.
164 Change what the access log records
Open the site, Settings tab, Logging, Log format. Three choices:
- Standard combined format. What every log tool already understands.
- Adds timings and upstream info. The same, plus how long the request took, which backend answered and how long that backend took. This is the one to be on while you are chasing anything slow.
- JSON, one object per line. For shipping into a log collector.
The middle one is worth having on permanently. When somebody says the site felt slow last Tuesday, it is the difference between an answer and a shrug.
165 Get logs a collector can read
Set Log format to JSON, one object per line. Every line is a complete object with named fields, so nothing downstream has to guess where one field ends and the next begins.
Anything that quotes a user agent or a referrer containing a space breaks a naive parser of the text format sooner or later. JSON does not have that problem, and it costs a little more disk in exchange.
166 Stop a noisy path filling the log
A health check hit every two seconds is 43,000 lines a day and none of them tell you anything.
- Open the site, Paths tab, and add the path, for example
/health. - Tick Settings for this path only.
- Untick Access log for that path.
The site keeps its log. That one path stops writing to it. Do the same for a metrics endpoint or anything else being polled.
167 Turn the error log up while chasing a problem
Open the site, Settings tab, Logging, Error log level. It runs from debug to crit and it sits on warn, which is the right place to leave it.
Debug is genuinely huge. It writes several lines per request and it will fill a disk overnight on a busy site. Turn it on, reproduce the problem, turn it straight back off. Setting a reminder is not a joke here.
Also tick Log missing files while you are looking for a 404 that should not be happening. It records the full path nginx tried, which usually makes the answer obvious.
168 Get the real visitor address into the logs behind a CDN
Every request arrives from the CDN, so the log records the CDN address and nothing else. The real address is in a header the CDN adds.
- Zones & Access, Access lists, and edit or make one.
- Tick Trust a forwarded client address.
- Put the CDN address ranges in Trusted proxies.
- Pick that access list on the site.
Only list the ranges the CDN publishes. Trusting the header from everybody means anybody can say they are anybody, and every address based rule you have stops meaning anything.