Nginx with [1] syslog logging patch and rate-limited log
[1] - https://github.com/yaoweibin/nginx_syslog_patch
./configure --add-module=syslog_patch
Sytax: syslog auth|authpriv|cron|daemon|ftp|kern|local0-7|lpr|mail|news|syslog|user|uucp [program_name] Default: none Context: main
Enable the syslog and set its facility. The default program name is nginx.
Syntax: error_log [syslog[:emerg|alert|crit|error|warn|notice|info|debug]]['|'file] [ debug | info | notice | warn | error | crit ] [rate_limit=limit] Default: ${prefix}/logs/error.log Context: main, http, server, location
Enable the error_log with the syslog and set its priority. The default priority is error. The error log can be sent to syslog, file or both. If the rate-limit option is not used, it defaults to 1 (log everything).
Note: if you set the error_log directive in the main block, the syslog is switched on by default.
Syntax: access_log off|[syslog[:emerg|alert|crit|error|warn|notice|info|debug]]['|'path] [format [buffer=size] [rate_limit=limit]] Default: access_log logs/access.log combined Context: http, server, location
Enable the access_log with the syslog and set its priority. The default priority is notice. The access log can be sent to syslog, file or both. If the rate-limit option is not used, it defaults to 1 (log everything).
Example configuration
worker_processes 1;
#Activate syslog logging and define facility and program name
syslog local6 nginx;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] $request '
'"$status" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
server {
listen 80;
server_name localhost;
#send the log to syslog and file.
# Log all error logs and a 1 % of access logs
access_log syslog:notice|logs/host1.access.log main rate_limited=100;
error_log syslog:notice|logs/host1.error.log;
location / {
root html;
index index.html index.htm;
}
}
server {
listen 80;
server_name www.example.com;
access_log syslog:warn|logs/host2.access.log main;
error_log syslog:warn|logs/host2.error.log;
location / {
root html;
index index.html index.htm;
}
}
server {
listen 80;
server_name www.test.com;
#send the log just to syslog.
access_log syslog:error main;
error_log syslog:error;
location / {
root html;
index index.html index.htm;
}
}
}