Isn't it possible to use multiple access_log to split the access log to traffic and 404 logs ? Or probably writing 404 logs to error_log. Posted at Nginx Forum: http://forum.nginx.org/read.php?2,215626,215634#msg-215634