LogsDB
Nginx logo

Nginx Error Log

Logs errors, warnings, and debug information from Nginx

Edit this page

Quick Facts

Default Path (Linux)
/var/log/nginx/error.log
Docker
stderr
Default Format
text
JSON Native
No
Rotation
logrotate

Log Example

Default format: Default Error Format

Example Log Entrylog
2025/12/20 14:32:18 [error] 1234#5678: *9012 open() "/var/www/html/missing.html" failed (2: No such file or directory), client: 192.168.1.50, server: example.com, request: "GET /missing.html HTTP/1.1", host: "example.com"

Structure:

YYYY/MM/DD HH:MM:SS [level] pid#tid: *cid message

Paths by Platform

Debian / Ubuntu
/var/log/nginx/error.log
RHEL / CentOS / Fedora
/var/log/nginx/error.log
Alpine
/var/log/nginx/error.log

Available Formats

Default Error Format

Default

Example:

2025/12/20 14:32:18 [error] 1234#5678: *9012 open() "/var/www/html/missing.html" failed (2: No such file or directory), client: 192.168.1.50, server: example.com, request: "GET /missing.html HTTP/1.1", host: "example.com"

Structure:

YYYY/MM/DD HH:MM:SS [level] pid#tid: *cid message

Fields Reference

FieldTypeDescriptionExample
timestamp
datetime
When the error occurred2025/12/20 14:32:18
level
string
Error severity levelerror
pid
integer
Process ID1234
tid
integer
Thread ID5678
cid
integer
Connection ID9012
message
string
Error message with contextopen() "/var/www/html/missing.html" failed (2: No such file or directory)
client
ip
Client IP address192.168.1.50
server
string
Server name from requestexample.com
request
string
HTTP request lineGET /missing.html HTTP/1.1

Parsing Patterns

Grok Patterns

default:

%{DATA:timestamp} \[%{WORD:level}\] %{NUMBER:pid}#%{NUMBER:tid}: \*%{NUMBER:cid} %{GREEDYDATA:message}

Regular Expressions

default:

^(?P<timestamp>\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}) \[(?P<level>\w+)\] (?P<pid>\d+)#(?P<tid>\d+): \*(?P<cid>\d+) (?P<message>.*)$

Collector Configurations

logstashruby
1filter {
2  grok {
3    match => { "message" => "%{DATA:timestamp} \[%{WORD:level}\] %{NUMBER:pid}#%{NUMBER:tid}: \*%{NUMBER:cid} %{GREEDYDATA:error_message}" }
4  }
5  date {
6    match => [ "timestamp", "yyyy/MM/dd HH:mm:ss" ]
7  }
8}

Configuration

Enable Logging

Directive:

error_log /var/log/nginx/error.log warn;

Second parameter is the minimum log level

Disable Logging

Directive:

error_log /dev/null;

Not recommended - you'll miss important errors

Log Rotation

Tool: logrotate | Config: /etc/logrotate.d/nginx

/etc/logrotate.d/nginx
/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
    endscript
}

Use Cases

Error rate monitoring

Track error frequency over time

level
timestamp

Missing files detection

Find 404 errors for static files

message

Upstream failures

Backend connection issues

message

Troubleshooting

Tested On

v1.26.2 on Ubuntu 24.04
jean_ops - 2025-12-15
Last updated: 2025-12-18 by jean_ops
2 contributors89 upvotes
Validated

Community Discussions

Help improve this documentation

Found an error or want to add more examples? Contributions are welcome!

EditReport Issue