Nginx · The edge of your stack

How do access and error logs work in Nginx?

Easylogserror_logaccess_logUpdated Oct 2026
Quiz this track

Short answer

access_log records requests in a configurable format; error_log records diagnostics at levels from debug to emerg. Both can be scoped per server or location and must be rotated to avoid filling disk.

Access logs answer who requested what and how long it took. Error logs explain why Nginx or an upstream failed. They serve different purposes, and production debugging usually needs both correlated by time and request ID.

nginx
http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$request_time"';

    access_log /var/log/nginx/access.log main buffer=32k flush=5s;
    error_log /var/log/nginx/error.log warn;
}

Operational notes

  • Error levels are debug, info, notice, warn, error, crit, alert and emerg
  • Log rotation usually sends USR1 to reopen files, or uses copytruncate
  • In containers, log to stdout and stderr so the platform collects output
  • Set access_log off for noisy health checks if they add no diagnostic value
  • Do not log authorization headers, cookies or query strings containing secrets
Debug logging is extremely verbose. Enable it temporarily for a specific server or location and switch back, rather than turning it on globally in production.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What is the difference between access_log and error_log?
  2. 2How does log rotation work without losing entries?
  3. 3Why log to stdout in a container?
  4. 4Which error log level should production use?

Say it in the interview

Access logs record each request with a configurable format, while error logs record internal and upstream failures by severity. I keep both scoped and rotated so they do not fill the disk. In containers I send them to stdout and stderr. I avoid logging secrets in query strings or headers, and I only enable debug logging temporarily because it is very noisy.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Nginx mock interview and get scored feedback on depth, clarity and confidence.