Access to nginx stream proxy is not logged in access_log file

Question

Thanks for checking my question.

I'm trying to log user access from browser, into access_log file which is not working now.

My system :

[User]-[TCP proxy]-[webserver]

nginx/1.6 in AWS EC2

nginx configuration :

load_module '/usr/lib64/nginx/modules/ngx_stream_module.so';
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

stream {
    log_format basic '$remote_addr [$time_local] '
                     '$protocol $status $bytes_sent $bytes_received '
                     '$session_time';
    access_log /var/log/nginx/access.log basic;

    server {
        listen 80;
        proxy_pass web.server.com:80;
    }

    server {
        listen 443;
        proxy_pass web.server.com:443;
    }
}

I opened the website from my local laptop through proxy server with Chrome, it opens well and the chrome devtool shows proxy server's ip in Headers tab > General > Remote Address field. I checked dig from my laptop and it indicated proxy server's ip, even tcpdump in proxy server showed good logs : sudo tcpdump -nn -A -s1500 -l -i eth0 port 443

(from tcpdump)
23:51:46.944945 IP user_ip.27149 > proxy_ip: length 357
23:51:46.945040 IP proxy_ip.44488 > webserver_ip.443: length 357
23:51:47.026161 IP webserver_ip.443 > proxy_ip.44488: length 364
23:51:47.026245 IP proxy_ip.443 > user_ip.27149: length 364

But when I opened the access log file in the proxy server there were no entries.

Unlike the similar question in stackoverflow Nginx access logs entries don't get created for some connections when they happen , there was no initial entry. just empty.

I suspect access_log config at first, but when I curl the same url from my laptop, entries suddenly appear in access_log file. It appears every time I curl the url.

user_ip [15/Feb/2021:23:21:25 +0000] TCP 200 1291080 3279 356.730
user_ip [15/Feb/2021:23:28:24 +0000] TCP 200 215 568 119.923
user_ip [15/Feb/2021:23:33:24 +0000] TCP 200 5646 643 300.140

I'm not sure why only curl requests were logged into the access_log file.

All requests were made on the https protocol.

Have you a tried a different file? Maybe it's not happy with two writers to the same file. — Allan Wind, Feb 16 '21 at 01:25
@AllanWind l changed the access.log file name to access1.log for 80, access2.log for 433, put each access_log setting into each server block then retired. But I still can't find access log from chrome, from both files. thanks for the idea. — Sunghyun Lee, Feb 16 '21 at 04:34
This doesn't answer your question but a working config might be a step forward https://stackoverflow.com/questions/42083611/how-to-make-nginx-print-full-log-for-tcp-stream. If new access log was created, that rules out permissions, otherwise you could try to log to syslog with `access_log syslog:unix:/dev/log`. Finally, my advise is to move this question to serverfault as it's not a programming question. — Allan Wind, Feb 16 '21 at 05:25
@AllanWind I see. thanks for the hint. let me try. I'll move this question to serverfault as well. — Sunghyun Lee, Feb 17 '21 at 02:19

score 0 · Answer 1 · answered Feb 17 '21 at 02:32

0

Moved the question to serverfault.

https://serverfault.com/questions/1053914/access-to-nginx-stream-proxy-is-not-logged-in-access-log-file

answered Feb 17 '21 at 02:32

Sunghyun Lee

11
2

Access to nginx stream proxy is not logged in access_log file

1 Answers1