Managing NGINX Logs for Troubleshooting
NGINX logs are one of the best tools for understanding what is happening on your server. When a website is slow, broken, returning errors, or being hit by suspicious traffic, the logs often show the answer before anything else.
There are two main logs:
Access log: /var/log/nginx/access.log
Error log: /var/log/nginx/error.log
The access log records visitor requests, including IP address, requested URL, response status, browser information, and request time depending on your log format. The error log records problems such as missing files, permission issues, upstream failures, SSL errors, and configuration problems.
Useful commands:
Watch access log live: sudo tail -f /var/log/nginx/access.log
Watch error log live: sudo tail -f /var/log/nginx/error.log
Show the last 100 error lines: sudo tail -n 100 /var/log/nginx/error.log
Search for 404 errors: sudo grep ” 404 ” /var/log/nginx/access.log
Search for 502 errors: sudo grep ” 502 ” /var/log/nginx/access.log
Check compressed rotated logs: sudo zgrep ” 500 ” /var/log/nginx/access.log.*.gz
Step-by-step troubleshooting:
- Reproduce the issue in your browser.
- Watch the error log while refreshing the page.
- Check the access log for the exact status code.
- Match the timestamp with your test.
- Fix the root cause, then test again.
Logs can grow quickly on busy servers, so Ubuntu normally rotates them automatically with logrotate. Avoid deleting active log files manually unless you understand the effect. If disk space is full, check log size with:
sudo du -sh /var/log/nginx/*
Good log reading turns guesswork into evidence-based troubleshooting.