NGINX error log format documentation

Hey!

I want to parse NGINX error logs. However, I did not find any
documentation concerning the used log format. While the meaning of some
fields like the data is pretty obvious, for some it is not at all. In
addition, I cannot be sure that my parser is complete if I do not have a
documentation of all the possible fields. Since it seems you can change
the access log format, but not that of the error log, I really have no
idea how to get the information I need.

Is there such documentation?

I also posted this question on StackOverflow:
http://stackoverflow.com/questions/16711573/nginx-error-log-format-documentation/16711684

Thank you!

On Thu, May 23, 2013 at 08:47:42PM +0200, Jan Teske wrote:

Hi there,

I want to parse NGINX error logs. However, I did not find any
documentation concerning the used log format.

less src/core/ngx_log.c

should probably show most of what you need. Combine that with

grep -r -A 2 ngx_log_error src

and looking at an error log and you should see that it is “a small
number
(five, I think) of fixed fields, followed by free-form text”.

While the meaning of some
fields like the data is pretty obvious, for some it is not at all. In
addition, I cannot be sure that my parser is complete if I do not have a
documentation of all the possible fields. Since it seems you can change
the access log format, but not that of the error log, I really have no
idea how to get the information I need.

I (strongly) suspect that the error log line format details is not
something that nginx wants to commit to holding stable.

If you want to do any more parsing than “free-form text after a handful
of
common fields”, then you’ll probably want to care about the version you
are using. Or at least, flag an imperfectly-recognised line if anything
doesn’t match what you expect.

Is there such documentation?

It’s hard to beat the contents of src/ for accuracy.

Choose the “identifying” string in the line you care about, find the
matching ngx_error_log call, and then see what free-form text it
provides
in the current version.

f

Francis D. [email protected]

That was helpful. Thank you!