The Nginx upstream module exposes embedded variables, which we can use to log them in the Nginx access log files.
Some of the variables are really interesting and could be of great use to the system administrators and in general to tune your systems (content delivery network?). For example, you can log
- $upstream_cache_status – the cache status of the object the server served. For each URI you will have in the logs if the item is from the cache (HIT) or the Nginx used an upstream server to get the item (MISS)
- $upstream_response_time – the time Nginx proxy needed to get the resource from the upstream server
- $upstream_addr – the Nginx upstream server used for the requested URI in the logs.
- $upstream_connect_time – the connect time to the specific
And many more you may check the documentation at the bottom with heading “Embedded Variables” – http://nginx.org/en/docs/http/ngx_http_upstream_module.html
For example, in peak hours, you can see how the time to get the resource from the upstream servers changes.
And you can substruct the time from the time your server served the URI to the client.
Of course, you can use this with any upstream case not only with proxy cache! These variables may be used with application backend servers like PHP (FastCGI) application servers and more. In a single log in the access log file, there could be information not only for the URI but for the time spent to generate the request in the application server.
Example
Logging in JSON format (JSON is just for the example, you can use the default string):
log_format main3 escape=json '{'
'"remote_addr":"$remote_addr",'
'"time_iso8601":"$time_iso8601",'
'"request_uri":"$request_uri",'
'"request_length":"$request_length",'
'"request_method":"$request_method",'
'"request_time":"$request_time",'
'"server_port":"$server_port",'
'"server_protocol":"$server_protocol",'
'"ssl_protocol":"$ssl_protocol",'
'"status":"$status",'
'"bytes_sent":"$bytes_sent",'
'"http_referer":"$http_referer",'
'"http_user_agent":"$http_user_agent",'
'"upstream_response_time":"$upstream_response_time",'
'"upstream_addr":"$upstream_addr",'
'"upstream_connect_time":"$upstream_connect_time",'
'"upstream_cache_status":"$upstream_cache_status",'
'"tcpinfo_rtt":"$tcpinfo_rtt",'
'"tcpinfo_rttvar":"$tcpinfo_rttvar"'
'}';
We included the variables we needed, but there are a lot more, check out the Nginx documentation for more.
Just add the above snippet to your Nginx configuration and activate it with the access_log directive:
access_log /var/log/nginx/example.com-json.log main3;
“main3” is the name of the format and it could be anything you like.
And the logs look like:
{"remote_addr":"10.10.10.10","time_iso8601":"2019-09-12T13:36:33+00:00","request_uri":"/i/example/bc/bcda7f798ea1c75f18838bc3f0ffbd1c_200.jpg","request_length":"412","request_method":"GET","request_time":"0.325","server_port":"8801","server_protocol":"HTTP/1.1","ssl_protocol":"","status":"404","bytes_sent":"332","http_referer":"https://example.com/test_1","http_user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0.2 Safari/602.3.12","upstream_response_time":"0.324","upstream_addr":"10.10.10.2","upstream_connect_time":"0.077","upstream_cache_status":"MISS","tcpinfo_rtt":"45614","tcpinfo_rttvar":"22807"}
{"remote_addr":"10.10.10.10","time_iso8601":"2019-09-12T13:36:33+00:00","request_uri":"/i/example/2d/2df5f3dfe1754b3b4ba8ac66159c0384_200.jpg","request_length":"412","request_method":"GET","request_time":"0.242","server_port":"8801","server_protocol":"HTTP/1.1","ssl_protocol":"","status":"404","bytes_sent":"332","http_referer":"https://example.com/test_1","http_user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0.2 Safari/602.3.12","upstream_response_time":"0.242","upstream_addr":"10.10.10.2","upstream_connect_time":"0.000","upstream_cache_status":"MISS","tcpinfo_rtt":"46187","tcpinfo_rttvar":"23093"}
{"remote_addr":"10.10.10.10","time_iso8601":"2019-09-12T13:36:41+00:00","request_uri":"/flv/example/test_1.ts?st=E05FMg-DSIAgRfVhbadUWQ&e=1568381799&sopt=pdlfwefdfsr","request_length":"357","request_method":"GET","request_time":"0.960","server_port":"8801","server_protocol":"HTTP/1.0","ssl_protocol":"","status":"200","bytes_sent":"3988358","http_referer":"","http_user_agent":"Lavf53.32.100","upstream_response_time":"0.959","upstream_addr":"10.10.10.2","upstream_connect_time":"0.000","upstream_cache_status":"MISS","tcpinfo_rtt":"46320","tcpinfo_rttvar":"91"}
{"remote_addr":"10.10.10.10","time_iso8601":"2019-09-12T14:09:34+00:00","request_uri":"/flv/example/aee001dce114c88874b306bc73c2d482_1.ts?range=564-1804987","request_length":"562","request_method":"GET","request_time":"0.613","server_port":"8801","server_protocol":"HTTP/1.0","ssl_protocol":"","status":"200","bytes_sent":"5318082","http_referer":"","http_user_agent":"AppleCoreMedia/1.0.0.16E227 (iPad; U; CPU OS 12_2 like Mac OS X; en_us)","upstream_response_time":"","upstream_addr":"","upstream_connect_time":"","upstream_cache_status":"HIT","tcpinfo_rtt":"45322","tcpinfo_rttvar":"295"}
It’s easy to print them beatiful in the console with the “jq” tool
[root@srv logging]# tail -f 10.10.10.10.log|awk 'BEGIN {FS="{"} {print "{"$2}'|jq "."
{
"remote_addr": "10.10.10.10",
"time_iso8601": "2019-09-12T13:36:33+00:00",
"request_uri": "/i/example/bc/bcda7f798ea1c75f18838bc3f0ffbd1c_200.jpg",
"request_length": "412",
"request_method": "GET",
"request_time": "0.325",
"server_port": "8801",
"server_protocol": "HTTP/1.1",
"ssl_protocol": "",
"status": "404",
"bytes_sent": "332",
"http_referer": "https://example.com/test_1",
"http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0.2 Safari/602.3.12",
"upstream_response_time": "0.324",
"upstream_addr": "10.10.10.2",
"upstream_connect_time": "0.077",
"upstream_cache_status": "MISS",
"tcpinfo_rtt": "45614",
"tcpinfo_rttvar": "22807"
}
{
"remote_addr": "10.10.10.10",
"time_iso8601": "2019-09-12T13:36:33+00:00",
"request_uri": "/i/example/2d/2df5f3dfe1754b3b4ba8ac66159c0384_200.jpg",
"request_length": "412",
"request_method": "GET",
"request_time": "0.242",
"server_port": "8801",
"server_protocol": "HTTP/1.1",
"ssl_protocol": "",
"status": "404",
"bytes_sent": "332",
"http_referer": "https://example.com/test_1",
"http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0.2 Safari/602.3.12",
"upstream_response_time": "0.242",
"upstream_addr": "10.10.10.2",
"upstream_connect_time": "0.000",
"upstream_cache_status": "MISS",
"tcpinfo_rtt": "46187",
"tcpinfo_rttvar": "23093"
}
{
"remote_addr": "10.10.10.10",
"time_iso8601": "2019-09-12T13:36:41+00:00",
"request_uri": "/flv/example/test_1.ts?st=E05FMg-DSIAgRfVhbadUWQ&e=1568381799&sopt=pdlfwefdfsr",
"request_length": "357",
"request_method": "GET",
"request_time": "0.960",
"server_port": "8801",
"server_protocol": "HTTP/1.0",
"ssl_protocol": "",
"status": "200",
"bytes_sent": "3988358",
"http_referer": "",
"http_user_agent": "Lavf53.32.100",
"upstream_response_time": "0.959",
"upstream_addr": "10.10.10.2",
"upstream_connect_time": "0.000",
"upstream_cache_status": "MISS",
"tcpinfo_rtt": "46320",
"tcpinfo_rttvar": "91"
}
{
"remote_addr": "10.10.10.10",
"time_iso8601": "2019-09-12T14:09:34+00:00",
"request_uri": "/flv/example/aee001dce114c88874b306bc73c2d482_1.ts?range=564-1804987",
"request_length": "562",
"request_method": "GET",
"request_time": "0.613",
"server_port": "8801",
"server_protocol": "HTTP/1.0",
"ssl_protocol": "",
"status": "200",
"bytes_sent": "5318082",
"http_referer": "",
"http_user_agent": "AppleCoreMedia/1.0.0.16E227 (iPad; U; CPU OS 12_2 like Mac OS X; en_us)",
"upstream_response_time": "",
"upstream_addr": "",
"upstream_connect_time": "",
"upstream_cache_status": "HIT",
"tcpinfo_rtt": "45322",
"tcpinfo_rttvar": "295"
}
3 misses and 1 hit, the hit 3 of the upstream variables we used are blank, because the server took the item from the cache.