Blackbox Logs

[Alan Gutierrez]

I attempted to get a discussion going on ServerFault.com regarding  
"blackbox" logs and Nginx. It didn't get the response I imagined, and  
I was told to ask here.

Here is an article about "blackbox" logs in Apache by Chris Josephes  
from 2004.

http://onlamp.com/pub/a/apache/2004/04/22/blackbox_logs.html

I've always kept these logs around on my Apache servers and they have  
come in handy. I'm trying to recreate them for Nginx. Here is the  
Apache format.

LogFormat "%a/%S %X %t \"%r\" %s/%>s %{pid}P/%{tid}P %T/%D %I/%O/%B"  
blackbox

Here's what Nginx blackbox format would look like, the unmapped Apache  
directives have question marks after their names.
access_log blackbox '$remote_addr/$remote_port X? [$time_local]  
"$request"'
                     's?/$status $pid/0 T?/D? I?/$bytes_sent/ 
$body_bytes_sent'
Here's a table of the variables I've been able to map from the Nginx  
documentation.
%a = $remote_addr - The IP address of the remote client.
%S = $remote_port - The port of the remote client.
%X = ? - Keep alive status.
%t = $time_local - The start time of the request.
%r = $request - The first line of request containing method verb, path  
and protocol.
%s = ? - Status before any redirections.
%>s = $status - Status after any redirections.
%{pid}P = $pid - The process id.
%{tid}P = N/A - The thread id, which is non-applicable to Nignx.
%T = ? - The time in seconds to handle the request.
%D = $request_time - The time in milliseconds to handle the request.
%I = ? - The count of bytes received including headers.
%O = $bytes_sent - The count of bytes sent including headers.
%B = $body_bytes_sent - The count of bytes sent excluding headers, but  
with a 0 for none instead of '-'.
So, I'm missing %I bytes received and %X keep alive status. The  
timings are off, but I don't mind.
Nginx doesn't to milliseconds like Apache, but rather seconds with  
millisecond precision. Making the log format exactly like the Apache  
blackbox log format would be a nice exercise, but it is not  
imperative.  If Nginx can do simple adjustments using multiplication  
that would be cool, but I haven't tried it yet, nor have I seen any  
examples of it.
Alan Gutierrez - http://twitter.com/bigeasy