On a standard Ubuntu package installation, Nginx reads /etc/nginx/nginx.conf, writes requests to /var/log/nginx/access.log, and writes diagnostics to /var/log/nginx/error.log. Configure log_format, access_log, and error_log in the appropriate Nginx context; validate with sudo nginx -t; reload the service; then let Ubuntu’s logrotate rotate and compress the files. The important operational choice is whether rotation uses copytruncate or moves and recreates files followed by an Nginx reopen signal.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Find the active configuration and log paths first
Ubuntu’s packaged Nginx layout is a useful starting point, not a guarantee. Packages from another repository, container images, and source builds can use different compile-time paths. Before editing anything, inspect the running binary:
As an Amazon Associate I earn from qualifying purchases.
nginx -VIn the output, look for --conf-path=, --error-log-path=, and --http-log-path=. Those configure arguments reveal the build’s default configuration and log locations. Also inspect the active configuration for included files; an included virtual-host file can override a setting you change elsewhere.
- Typical configuration:
/etc/nginx/nginx.conf - Typical access log:
/var/log/nginx/access.log - Typical error log:
/var/log/nginx/error.log
Do not assume that a familiar path is active until the binary and configuration confirm it. A logrotate rule aimed at the wrong path can run successfully while Nginx continues writing somewhere else.
Understand what each Nginx logging directive controls
error_log: diagnostics and severity
error_log sends Nginx diagnostic messages to a file, stderr, or a syslog: destination. It also sets a minimum severity. For example:
error_log /var/log/nginx/error.log warn;With warn, warnings and messages more severe than warnings are included. A more restrictive level reduces noise; a more permissive level can provide more detail while troubleshooting. Set the level deliberately because increasing diagnostic volume also increases storage and review work.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallaccess_log: requests and format
access_log records requests to a destination using a named format:
access_log /var/log/nginx/access.log main;The module reference’s default is logs/access.log combined;. Ubuntu package builds resolve that conventional location to /var/log/nginx/access.log. The format name after the path must exist in a log_format directive, unless you use the predefined combined format.
Scope, inheritance, and overrides
Both directives can be configured at the levels supported by their modules, including the main, http, server, and location contexts where applicable. A setting at a lower level overrides an inherited setting. This makes per-site and per-endpoint logging possible, but it can also explain why a request is absent from the file you expected.
If multiple error_log or access_log directives are present at the same level, Nginx can write to each configured destination. Review all applicable files before removing one; a monitoring stream or a site-specific audit file may be intentional.
Free tools Windows power users keep installed
One-click scans. No signup required.
Configure a practical file-based logging setup
For a conventional Ubuntu installation, define the format and default destinations in the http context. Place the following inside the existing http { ... } block rather than creating a second top-level http block:
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent"';
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log warn;
server {
listen 80;
server_name example.com;
# server-specific directives
}
}The format records the client address, authenticated user when present, timestamp, request line, status, response size, referrer, and user-agent. Keep the standard combined format when it already answers your operational questions. Define a custom format only when you need additional fields or a different representation.
For multiple sites, a shared access_log in http keeps request records together. A site-specific declaration in a server block can separate virtual hosts. A location-level declaration is useful for a deliberately narrow endpoint, but it should be documented because inherited assumptions no longer apply there.
Design a custom access-log format without losing useful context
Define every custom format in the http context, then reference its name from access_log. For example, the following keeps the common fields while making the format name explicit:
http {
log_format game_backend '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent"';
access_log /var/log/nginx/access.log game_backend;
error_log /var/log/nginx/error.log warn;
}Use a stable name that describes the records rather than the current application release. If a later configuration references a name that was never defined, nginx -t should catch the error before reload.
Conditional logging
The access-log module supports conditional logging with if=$loggable. A map can set that variable to zero for requests you intentionally want to suppress. This is useful for excluding selected health checks or other known noise, but the condition changes what evidence is available during an incident. Keep the map and the reason for exclusions close to the logging configuration so an operator understands what is missing.
Buffering and descriptor caching
For high-volume sites, the access-log module supports buffered writes and descriptor caching. These features can reduce write overhead, but they change when bytes reach the filesystem and how file descriptors are held. Introduce them only when you understand their operational effect and have verified that your rotation method still causes Nginx to write to the intended file.
Choose a rotation strategy that matches Nginx’s file descriptors
Ubuntu’s logrotate reads configuration files and a state file, then applies rules that can rotate, compress, and remove logs. The key decision is how the active file is replaced.
| Strategy | How it works | Descriptor behavior | Main risk or requirement |
|---|---|---|---|
copytruncate |
Copies the current file to a rotated name, then truncates the original file in place. | Nginx can keep its existing descriptor because the original pathname remains. | A small interval of writes can be lost during the copy/truncate window. |
| Move and recreate | Moves the active file to its rotated name and creates a new file at the original pathname. | Nginx must close and reopen its log descriptors. | Requires a correct post-rotation signal or service action; otherwise Nginx may continue writing to the moved file. |
Do not combine both approaches in one rule. Choose the method used by the installed Ubuntu package rule or by your operational policy, then verify the result after a forced test rotation.
Inspect and adapt Ubuntu’s logrotate rule
Ubuntu normally supplies an Nginx rule under /etc/logrotate.d/nginx. Inspect it before replacing or extending it. The exact shipped contents vary by Ubuntu release and package, so preserve the installed owner, group, schedule, PID path, and reopen action unless you have a reason to change them.
A generic move-and-recreate rule looks like this:
/var/log/nginx/*.log {
daily
rotate 14
missingok
notifempty
compress
delaycompress
create 0640 www-data adm
postrotate
[ -s /run/nginx.pid ] && kill -USR1 $(cat /run/nginx.pid)
endscript
}In this example, daily schedules a daily check, rotate 14 retains fourteen rotated files, compress compresses older files, delaycompress postpones compression of the newest rotated file, missingok avoids an error when a file is absent, and notifempty skips empty files. Those values are a template, not a universal policy. Select retention and frequency according to traffic, disk capacity, incident-response needs, and local requirements.
create 0640 www-data adm is likewise an example. The owner and group must match the installed service and the users or agents that need to read the logs. An incorrect group can make rotation appear successful while preventing monitoring or administrators from reading new files.
Recommended Free Tools
The postrotate command sends USR1 to the PID in /run/nginx.pid after the move and recreation. Confirm the PID path used by the active service before adopting it. If the service uses a different path or service action, adapt the rule rather than signaling a nonexistent process.
When copytruncate is appropriate
A rule using copytruncate avoids a reopen signal and can be compatible with a process whose descriptor handling is difficult to change. Its trade-off is the copy/truncate window: requests arriving then can produce a small gap in the captured log. For audit-sensitive traffic, that loss may be unacceptable; for a low-risk diagnostic stream, avoiding a reopen dependency may be more important.
Apply configuration changes safely
- Edit the active configuration. Change
/etc/nginx/nginx.confor the included site file that owns the relevanthttp,server, orlocationsetting. Keeplog_formatinhttp. - Validate syntax and references. Run
sudo nginx -t. Stop here if validation fails; do not reload a configuration that Nginx rejects. - Reload through the service manager. After a successful test, reload Nginx using the host’s service manager so the running process adopts the configuration without an unnecessary stop/start cycle.
- Generate and inspect traffic. Make a request through each relevant virtual host or endpoint, then inspect the configured access log. Trigger an intentional diagnostic condition only if it is safe, and check the configured error destination.
- Check the actual destination. If the directives use
syslog:, inspect the configured syslog stream rather than expecting a new local file.
A successful syntax test proves that the configuration is parseable; it does not prove that a virtual host received the request, that permissions permit writing, or that a remote syslog receiver is reachable.
Test logrotate before relying on it
Use a dry run to see what logrotate would do without changing files:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemssudo logrotate -d /etc/logrotate.confThe command reads the global configuration, included rules, and logrotate’s state information. Review the selected paths, rule ordering, and whether the Nginx rule is being skipped because a file is missing or empty.
When a controlled test is appropriate, force one rotation:
sudo logrotate -f /etc/logrotate.confAfterward, inspect the rotated filename, compression state, ownership and mode, retention count, and the fresh active file. Generate a new request and verify that the new entry appears in the active file. With a move-and-recreate rule, this check confirms that the reopen action reached the running Nginx process. With copytruncate, it confirms that writes continue through the original descriptor.
Do not use a forced rotation casually on a production system with strict retention or downstream ingestion. It changes the state file and can create an extra rotation outside the normal schedule.
Troubleshoot common failures
nginx -t reports an unknown log format
The access_log line references a format name that is not defined in the applicable http context. Define the format before the access-log declaration, or use the predefined combined format. Also check spelling and included-file order.
Requests are missing from the expected file
- Confirm the active binary paths with
nginx -V. - Check whether a
serverorlocationdeclaration overrides the inheritedaccess_log. - Check whether conditional logging suppresses the request.
- Verify that the request reached the intended virtual host and that the process can write the destination.
Error messages are too noisy or too sparse
Review the severity on error_log. The configured level is a minimum threshold, so changing it changes which diagnostic messages are retained. Keep a practical level for normal operation and temporarily increase detail only under a controlled troubleshooting plan.
Nginx appears to stop writing after rotation
This usually indicates a mismatch between the rotation method and descriptor handling. If the rule moved and recreated the file, verify that its postrotate action used the correct PID path and sent the reopen signal to the running master process. If the rule used copytruncate, verify that the original file was truncated in place and that permissions on the file still allow Nginx to write. Inspect both the active and rotated filenames to determine where new bytes are going.
New files have the wrong permissions
Review the create mode, owner, and group in the installed logrotate rule. The example 0640 www-data adm is not guaranteed to match every Ubuntu installation. Align it with the service account and the readers required by your monitoring and operations teams.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The dry run does not select the rule
Check that the rule is included from /etc/logrotate.conf, that its glob matches the configured Nginx paths, and that missingok or notifempty is not intentionally skipping the file. A path mismatch is especially common after changing Nginx’s compile-time or directive-level destinations.
Forward logs to syslog when centralization matters
Nginx can send either access or error records to a syslog: destination. Parameters include server= with an IP address, hostname, or UNIX socket; an optional port; facility=; tag=; severity=; and nohostname. If no port is supplied, UDP port 514 is used.
error_log syslog:server=192.0.2.10:514,facility=local7,tag=nginx warn;
access_log syslog:server=192.0.2.10:514,facility=local7,tag=nginx,severity=info combined;Use a syslog destination when a central receiver, shared search, or cross-host correlation is more valuable than keeping every record only on the web server. The receiver, transport, firewall rules, and retention policy remain separate responsibilities. Forwarding does not automatically preserve a local copy, compress records, or guarantee delivery when the receiver is unavailable.
| Question | Local files with logrotate | Syslog forwarding |
|---|---|---|
| Where records are stored | On the Nginx host, under configured file paths. | At the configured syslog receiver; local retention is optional and separately configured. |
| Retention and compression | Controlled directly with logrotate options such as rotate, compress, and delaycompress. |
Controlled by the receiver’s policy; Nginx itself does not supply that retention. |
| Failure behavior | Continues locally if the filesystem remains writable, subject to disk capacity. | Depends on the receiver, transport, firewall, and destination availability; forwarding must be monitored. |
| Operational complexity | Requires file ownership, rotation, compression, and reopen behavior. | Requires receiver configuration, network controls, message routing, and a decision about local copies. |
Make rotation and logging operationally predictable
- Keep one source of truth for paths. The Nginx directives and the logrotate glob must name the same files.
- Document overrides. Record why a particular server or location has its own log destination or why a condition suppresses requests.
- Match the reopen method to the rule. Move/recreate requires a post-rotation reopen;
copytruncateavoids that signal but accepts a possible write gap. - Check ownership after every policy change. A newly created file must be writable by Nginx and readable by the intended operators or collectors.
- Use a retention count that supports investigations. The sample value of fourteen rotations is illustrative; select a period that fits traffic and policy.
- Test the complete lifecycle. Validate syntax, reload, generate traffic, dry-run rotation, force a controlled rotation, and verify continued writes.
NGINX describes logging as essential for troubleshooting and understanding how traffic flows through infrastructure. In practice, that value depends on preserving the records you need, rotating them without silently detaching Nginx from its active file, and checking the result after each configuration change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Quick implementation checklist
- Run
nginx -Vand confirm the active configuration and default path arguments. - Inspect included Nginx files and
/etc/logrotate.d/nginxbefore editing. - Define a custom
log_formatonly ifcombinedlacks required fields. - Set
access_loganderror_logat the lowest scope that matches your operational need. - Choose either
copytruncateor move/recreate plus reopen; do not mix them. - Run
sudo nginx -t, then reload through the service manager. - Confirm fresh access and error records, or inspect the configured syslog stream.
- Run
sudo logrotate -d /etc/logrotate.confbefore a controlled forced test. - After testing, verify file names, compression, ownership, retention, and continued writes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
