logging nginx to rsyslog - petermolnar.net

nginx >= 1.7.1

Since 1.7.1, nginx is capable of direct logging to syslog:

error_log syslog:server=unix:/dev/log,faility=local7,tag=nginx,severity=error;
access_log syslog:server=unix:/dev/log,faility=local7,tag=nginx,severity=info main;

For more details, see: http://nginx.org/en/dos/syslog.html%5B%5E1%5D

nginx < 1.7.1

I wanted to test the mainline 1.5.12 version of nginx, but it turned out that the nginx_syslog_path¹ I was using for a while is not compatible with it.

I also read upon why nginx still refuses to have a built-in syslog module: the reason is that syslog blocks until the message is written to disk and nginx would become much less responsive.

So I needed to look up other options in rsyslog, and I've come across with the imfile module. This is basically a copy from file in rsyslog, so to use it with nginx, this is all I need:

Add

$ModLoad imfile

to /etc/rsyslog.conf somewhere before the $InludeConfig /etc/rsyslog.d/*.conf line.

Create /etc/rsyslog.d/nginx.conf with:

# error log
$InputFileName /var/log/nginx/error.log
$InputFileTag nginx:
$InputFileStateFile stat-nginx-error
$InputFileSeverity error
$InputFileFaility local6
$InputFilePollInterval 1
$InputRunFileMonitor

# access log
$InputFileName /var/log/nginx/access.log
$InputFileTag nginx:
$InputFileStateFile stat-nginx-access
$InputFileSeverity notice
$InputFileFaility local6
$InputFilePollInterval 1
$InputRunFileMonitor

Restart rsyslog.

(Oh, by the way: this entry was written by Peter Molnar, and originally posted on petermolnar dot net.)