Nginx日志格式不生效

1.案例现象

启动 Nginx，运行一段时间发现 access 日志并没有遵循我们的配置的日志格式所输出

2.定位问题

日志没有按照格式输出，很大原因就是 Nginx 配置有问题

查看一下 Nginx 的配置，重点关注一下日志配置字段

cat /etc/nginx/nginx.conf

     log_format  main  '"$time_local" "$remote_addr" "$request" "$request_time" "$upstream_response_time" "$upstream_addr" '
                      '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for" "$request_time" "$upstream_response_time"';

   # access_log  /var/log/nginx/access.log  main;

这么看日志格式配置好像没有什么问题

我们去看下Nginx官网是怎么说的吧

上面这两张图片所讲的内容大概就是：

1. Nginx预定义了名为combined日志格式，如果没有明确指定日志格式默认使用该格式
2. 如果自定义日志格式，要想使其生效，就必须用 access_log 指定调用
3. 如果自定义了日志格式但是没有使用 access_log 调用，依旧是用的默认格式
4. http段也必须明确指定调用main格式才会生效，否则还是会调用默认的combined格式

我们通过不同日志配置场景来分别验证一下：

1. 没有配置日志格式字段，access_log也没有指定调用
2. 配置默认日志格式字段，access_log没有指定调用
3. 配置默认日志格式字段，access_log有指定调用
4. 配置自定义格式字段，access_log没有指定调用
5. 配置自定义格式字段，access_log有指定调用

• 没有配置日志格式字段，access_log也没有指定调用

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
access_log /var/log/nginx/access.log;
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    ...
}

实时查看 nginx access.log，然后去访问 Nginx，日志输出如下：

192.168.149.131 - - [21/Sep/2022:08:57:37 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"
192.168.149.131 - - [21/Sep/2022:08:57:38 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"

• 使用Nginx默认日志格式字段，access_log没有指定调用

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
access_log /var/log/nginx/access.log;
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
}

实时查看 nginx access.log，然后去访问 Nginx，日志输出如下：

192.168.149.131 - - [21/Sep/2022:08:58:02 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"
192.168.149.131 - - [21/Sep/2022:08:58:05 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"

• 配置默认日志格式字段，access_log有指定调用

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
access_log /var/log/nginx/access.log;
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  logs/access.log  main;
}

实时查看 nginx access.log，然后去访问 Nginx，日志输出如下：

192.168.149.131 - - [21/Sep/2022:09:02:03 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"
192.168.149.131 - - [21/Sep/2022:09:02:08 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"

• 配置自定义格式字段，access_log没有指定调用

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
access_log /var/log/nginx/access.log;
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '"$time_local" "$remote_addr" "$request" "$request_time" "$upstream_response_time" "$upstream_addr" '
                      '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for" "$request_time" "$upstream_response_time"';
    
}

实时查看 nginx access.log，然后去访问 Nginx，日志输出如下：

192.168.149.131 - - [21/Sep/2022:09:05:57 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"
192.168.149.131 - - [21/Sep/2022:09:05:58 +0800] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0"

• 配置自定义格式字段，access_log 有指定调用

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
access_log /var/log/nginx/access.log;
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '"$time_local" "$remote_addr" "$request" "$request_time" "$upstream_response_time" "$upstream_addr" '
                      '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for" "$request_time" "$upstream_response_time"';
    access_log  logs/access.log  main;
}

实时查看 nginx access.log，然后去访问 Nginx，日志输出如下：

"21/Sep/2022:09:08:45 +0800" "192.168.149.131" "HEAD / HTTP/1.1" "0.000" "-" "-" 200 0 "-" "curl/7.29.0" "-" "0.000" "-"
"21/Sep/2022:15:58:46 +0800" "192.168.149.131" "HEAD / HTTP/1.1" "0.000" "-" "-" 200 0 "-" "curl/7.29.0" "-" "0.000" "-"

总结：

1. Nginx 预定义了名为 combined 日志格式，如果没有明确指定日志格式默认使用该格式
2. 配置了日志格式，如果没有指定调用，配置的日志格式是不会生效的

3.解决问题

既然找到问题之后我们在 Nginx 配置文件中加入 access_log 指定调用字段，让自定义的日志格式生效即可

    log_format  main  '"$time_local" "$remote_addr" "$request" "$request_time" "$upstream_response_time" "$upstream_addr" '
                      '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for" "$request_time" "$upstream_response_time"';
    access_log  logs/access.log  main;