logging nginx to rsyslog

log nginx to rsyslog without blocking
Table of Contents

nginx >= 1.7.1

Since 1.7.1, nginx is capable of direct logging to syslog:

error_log syslog:server=unix:/dev/log,faility=local7,tag=nginx,severity=error;
access_log syslog:server=unix:/dev/log,faility=local7,tag=nginx,severity=info main;

For more details, see: http://nginx.org/en/dos/syslog.html%5B%5E1%5D

nginx < 1.7.1

I wanted to test the mainline 1.5.12 version of nginx, but it turned out that the nginx_syslog_path1 I was using for a while is not compatible with it.

I also read upon why nginx still refuses to have a built-in syslog module: the reason is that syslog blocks until the message is written to disk and nginx would become much less responsive.

So I needed to look up other options in rsyslog, and I've come across with the imfile module. This is basically a copy from file in rsyslog, so to use it with nginx, this is all I need:


$ModLoad imfile

to /etc/rsyslog.conf somewhere before the $InludeConfig /etc/rsyslog.d/*.conf line.

Create /etc/rsyslog.d/nginx.conf with:

# error log
$InputFileName /var/log/nginx/error.log
$InputFileTag nginx:
$InputFileStateFile stat-nginx-error
$InputFileSeverity error
$InputFileFaility local6
$InputFilePollInterval 1

# access log
$InputFileName /var/log/nginx/access.log
$InputFileTag nginx:
$InputFileStateFile stat-nginx-access
$InputFileSeverity notice
$InputFileFaility local6
$InputFilePollInterval 1

Restart rsyslog.

  1. https://github.om/yaoweibin/nginx_syslog_path↩︎