Configuring Nginx Proxy Manager for Apache Combined logging format

Nginx Proxy Manager is a popular containerized application, which provides a reverse proxy with an easy to use GUI frontend.

By default it generates logs in its own custom format instead of the popular Apache “combined” or Apache “virtual host combined” log format that is generated by plain nginx or Apache web servers. This makes it challenging to process the generated logs with automated tools.

Fortunately there is an easy solution. Nginx Proxy Manager has a number of hook points into its nginx configuration, which we can utilize to insert additional commands into the generated configuration.

Making it standard

The default docker compose configuration puts all configuration data in the data directory. The data/nginx directory contains configuration snippets that are used to compose the final nginx configuration. To customize the configuration, we first create a data/nginx/custom directory. Next we add two configuration snippets.

The contents of data/nginx/custom/http_top.conf will be inserted at the top of the http block in the nginx configuration. The following code snippet configures the standard Apache “combined log format with virtual host data”.

log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';

The file data/nginx/custom/server_proxy.conf will be inserted in the server configuration block of each proxied host. It tells the proxy to log all requests to a single log file in the format we have defined above.

access_log /data/logs/access.log vcombined;

Once the above changes are in place, we need to reload the nginx configuration:

$ docker exec <name_of_docker_container> nginx -s reload

The result

All HTTP requests will now be written into the /data/logs/access.log file within the docker container in the standard Apache log format. You can place this file or the /data/logs directory in a docker volume, so it can be shared with other docker containers that need to process the logs.

To observe the logs in real time, use the following command:

$ docker exec -it <name_of_docker_container> tail -F /data/logs/access.log

You should see something like this:

host.example.com.com:443 10.99.88.77 - - [12/Jan/2024:23:33:58 +0000] "GET /api/users/me?expand=permissions HTTP/2.0" 200 529 "https://host.example.com/nginx/proxy" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"

Conclusion

Nginx Proxy Manager is a powerful yet easy to use reverse proxy. While the default configuration might not match all use cases, it is easy to adjust it to your own preferences. Processing web server logs with standard tools is a common request, and with the above steps it should be easier to do so. If you are looking for a powerful and beautiful visualization of your logs, check out goaccess,

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *