Nginx understanding access log column
I understand all the column of this app's access log- IP, date, request, response code and... except the next column is what I don't understand (in the example below, 177, 4223, 4356). What is this stands for?
66.249.65.159 - - [06/Nov/2014:19:10:38 +0600] "GET /news/53f8d72920ba2744fe873ebc.html HTTP/1.1" 404 177 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.65.3 - - [06/Nov/2014:19:11:24 +0600] "GET /?q=%E0%A6%AB%E0%A6%BE%E0%A7%9F%E0%A6%BE%E0%A6%B0 HTTP/1.1" 200 4223 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.65.62 - - [06/Nov/2014:19:12:14 +0600] "GET /?q=%E0%A6%A6%E0%A7%8B%E0%A7%9F%E0%A6%BE HTTP/1.1" 200 4356 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
Edit: I've googled, but couldn't find any answer.
The column after "Response Code" (i.e. status) is "Bytes Sent".
The default log format in nginx is called "combined". It is the equivalent to the following configuration.
# nginx.conf
http {
...
log_format combined '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
...
}
Source: Module ngx_http_log_module
In your given example,
177, 4223, 4356 indicates the number of bytes sent, excluding the HTTP headers.
Default logs provided by both Apache and NGINX are pretty much identical. While the variable naming conventions differ, the information available is relatively the same.
NGINX Logging Variables Documentation
In this link you can find all possible variables that can be used in nginx logging with their descriptions ...
Additionally, you can config nginx to create custom logs with your favourite template:
-
edit /etc/nginx/nginx.conf
-
find 'access_log' lines
-
before this line, define your logging template(like below for example):
log_format firelog '"$time_local" client=$remote_addr ' 'method=$request_method request="$request" ' 'request_length=$request_length ' 'status=$status bytes_sent=$bytes_sent ' 'body_bytes_sent=$body_bytes_sent ' 'referer=$http_referer ' 'user_agent="$http_user_agent" ' 'upstream_addr=$upstream_addr ' 'upstream_status=$upstream_status ' 'request_time=$request_time ' 'upstream_response_time=$upstream_response_time ' 'upstream_connect_time=$upstream_connect_time ' 'upstream_header_time=$upstream_header_time ' 'body=$request_body';
-
then update access line like below:
access_log /var/log/nginx/firelog.log firelog;