Nginx understanding access log column

LoggingNginx

Logging Problem Overview


I understand all the column of this app's access log- IP, date, request, response code and... except the next column is what I don't understand (in the example below, 177, 4223, 4356). What is this stands for?

66.249.65.159 - - [06/Nov/2014:19:10:38 +0600] "GET /news/53f8d72920ba2744fe873ebc.html HTTP/1.1" 404 177 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.65.3 - - [06/Nov/2014:19:11:24 +0600] "GET /?q=%E0%A6%AB%E0%A6%BE%E0%A7%9F%E0%A6%BE%E0%A6%B0 HTTP/1.1" 200 4223 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.65.62 - - [06/Nov/2014:19:12:14 +0600] "GET /?q=%E0%A6%A6%E0%A7%8B%E0%A7%9F%E0%A6%BE HTTP/1.1" 200 4356 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

Edit: I've googled, but couldn't find any answer.

Logging Solutions


Solution 1 - Logging

The column after "Response Code" (i.e. status) is "Bytes Sent".

The default log format in nginx is called "combined". It is the equivalent to the following configuration.

# nginx.conf
http {
  ...
  log_format combined '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent"';
  ...
}

Source: Module ngx_http_log_module

Solution 2 - Logging

In your given example,

177, 4223, 4356 indicates the number of bytes sent, excluding the HTTP headers.

Default logs provided by both Apache and NGINX are pretty much identical. While the variable naming conventions differ, the information available is relatively the same.

Solution 3 - Logging

NGINX Logging Variables Documentation

In this link you can find all possible variables that can be used in nginx logging with their descriptions ...

Additionally, you can config nginx to create custom logs with your favourite template:

  1. edit /etc/nginx/nginx.conf

  2. find 'access_log' lines

  3. before this line, define your logging template(like below for example):

    log_format firelog '"$time_local" client=$remote_addr ' 'method=$request_method request="$request" ' 'request_length=$request_length ' 'status=$status bytes_sent=$bytes_sent ' 'body_bytes_sent=$body_bytes_sent ' 'referer=$http_referer ' 'user_agent="$http_user_agent" ' 'upstream_addr=$upstream_addr ' 'upstream_status=$upstream_status ' 'request_time=$request_time ' 'upstream_response_time=$upstream_response_time ' 'upstream_connect_time=$upstream_connect_time ' 'upstream_header_time=$upstream_header_time ' 'body=$request_body';

  4. then update access line like below:

    access_log /var/log/nginx/firelog.log firelog;

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionDewsworldView Question on Stackoverflow
Solution 1 - LoggingstevendanielsView Answer on Stackoverflow
Solution 2 - LoggingShreeView Answer on Stackoverflow
Solution 3 - LoggingEyni KaveView Answer on Stackoverflow