nginx---自定义日志格式和json日志

系统中自带的格式

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;
    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

log_format 只能在http语句块中定义，这里main是日志定义格式的名称  （可以多个）
access_log /var/log/nginx/access.log main; 这里就引用了main

access_log 可以定义在：http, server, location, if in location,limit_except

 　　自定义日志格式：

vim /etc/nginx/nginx.conf 

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';


    log_format  testlog  '$remote_addr - $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer"' ;


    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;
    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

testlog 定义的日志规则名称

$remote_addr 客户端IP地址 、$remote_user 用户账号、[$time_local] 时间

$request 发的请求、$status 状态码、$body_bytes_sent 响应报文的实际大小

$http_referer 从哪个网站跳转过来的

　　虚拟主机引用刚刚定义的testlog日志规则

vim /etc/nginx/conf.d/test.conf 

server {
        access_log /var/log/nginx/a.net.log testlog;
        server_name www.a.net;
        root /data/site1;
        location / {
        }
        location /admin {
                root /data/;
                auth_basic "Admin Page";
                auth_basic_user_file /etc/nginx/conf.d/.nginx_passwd;
        }
        location /nginx_status {
        stub_status;
        allow 127.0.0.1;
        allow 172.16.8.0/24;
        allow 192.168.1.0/24;
        deny all;
        }
}

放在server里任意位置即可

---

 　　自定义json日志格式

1、修改nginx主配置文件

vim /etc/nginx/nginx.conf 

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;
daemon off;

events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';


    log_format  testlog  '$remote_addr - $remote_user [$time_local] "$request" '
             '$status $body_bytes_sent "$http_referer"' ;
    
    log_format access_json '{"@timestamp":"$time_iso8601",'
    '"host":"$server_addr",'
    '"clientip":"$remote_addr",'
    '"size":$body_bytes_sent,'
    '"responsetime":$request_time,'
    '"upstreamtime":"$upstream_response_time",'
    '"upstreamhost":"$upstream_addr",'
    '"http_host":"$host",'
    '"uri":"$uri",'
    '"domain":"$host",'
    '"xff":"$http_x_forwarded_for",'
    '"referer":"$http_referer",'
    '"tcp_xff":"$proxy_protocol_addr",'
    '"http_user_agent":"$http_user_agent",'
    '"status":"$status"}';
    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;
    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

2、引用自定义的json格式

vim /etc/nginx/conf.d/test.conf 

server {
        access_log /var/log/nginx/a.net.log access_json;
        server_name www.a.net;
        root /data/site1;
        location / {
        }
        location /admin {
                root /data/;
                auth_basic "Admin Page";
                auth_basic_user_file /etc/nginx/conf.d/.nginx_passwd;
        }
        location /nginx_status {
        stub_status;
        allow 127.0.0.1;
        allow 172.16.8.0/24;
        allow 192.168.1.0/24;
        deny all;
        }
}

正在运行的nginx删除日志是不会在生成的，需要重启才会生成日志文件

如果实在日志文件过大的话，想将其复制到其他位置，然后使用重定向技术将里面清零

> /var/log/nginx/a.net.log

或者

cat /dev/null > /var/log/nginx/a.net.log 

---

open_log_file_cache max=N [inactive=time] [min_uses=N] [valid=time];
　　open_log_file_cache off;
　　　　缓存各日志文件相关的元数据信息
　　　　　　max：缓存的最大文件描述符数量
　　　　　　min_uses：在inactive指定的时长内访问大于等于此值方可被当作活动项
　　　　　　inactive：非活动时长
　　　　　　valid：验证缓存中各缓存项是否为活动项的时间间隔