Home / server / Questions / 988364
Accepted
VictorMJ
Asked: 2019-10-18 00:58:50 +0800 CST

Extrange logs appearing on /usr/share/nginx

  • 772

We have a remote syslog server where we store the logs of all our VMs. Everything is working fine except that, on some machines with nginx, a log file with everything that has been sent to the remote syslog server has appeared on directory /usr/share/nginx.

I have checked the rsyslog conf aswell as the nginx conf but I cant't figure where is the problem. I delete that log file on /usr/share/nginx and after a few days it appears again.

django-03 mario:~$ ls -larth /usr/share/nginx/
total 1,5G
drwxr-xr-x   2 root     root   23 dic  5  2018 html
drwxr-xr-x 150 root     root 4,0K abr 23 13:34 ..
drwxr-xr-x   3 root     root  148 sep  6 06:26 .
-rw-r--r--   1 www-data root 247M oct 17 09:31 syslog:server=someserver.vps:10514,tag=nginxerror
-rw-r--r--   1 www-data root 1,2G oct 17 09:33 syslog:server=someserver.vps:10514,tag=nginxaccess

Here is the rsyslog configuration.

###############
#### RULES ####
###############                 
... Rest of the file ...
.
.
.

*.* @@someserver.vps:10514

As you can see the rsyslog is sending everything to the someserver.vps:10514 and is working fine.

Here is the nginx configuration, we send logs both ways to the remote server and to the local machine on /var/log/syslog.

... Rest of the file ...
.
.
.
        ##
        # Logging Settings
        ##
        log_format vhosts '$host $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';

        access_log /var/log/nginx/access.log vhosts;
        error_log /var/log/nginx/error.log;
        access_log syslog:server=someserver.vps:10514,tag=nginxaccess vhosts;
        error_log syslog:server=someserver.vps:10514,tag=nginxerror;


        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}

As you can see on /usr/share/nginx/ is appearing the name of someserver.vps with all the logs. It's like 1.2G and we don't know why is appearing there.

nginx

2 Answers

  1. Seems like nginx couldn't resolve the someserver.vps address (we had some dns problems a few days ago) and, as you said nginx was treating the syslog as a literal filename, and created on the daemons home directory.

    We were receiving logs on the remote syslog server thanks to the rsyslog configuration. And that's what was confusing me.

    Thank you very much for your help

    • 1
  2. Best Answer

    From the documentation:

    Logging to syslog is available since version 1.7.1.

    If your version is older, nginx would treat the syslog directives as a literal filename.

    In that case this line:

    access_log syslog:server=someserver.vps:10514,tag=nginxaccess vhosts;

    configures nginx to write an access log to a file with the name syslog:server=someserver.vps:10514,tag=nginxaccess. There is no absolut path, so it is created in the daemons home directory.

    • 0