Status of Nginx centralised logging

[Maxim Dounin]

Hello!

On Wed, Jun 06, 2012 at 11:39:30PM +0100, Jonathan Matthews wrote:

> Hi all -
> 
> As many of us will have discovered over the course of our careers,
> centralised/non-local logging is an important part of any non-trivial
> infrastructure.
> 
> I'm aware of different patches that add syslogging capabilities to
> different Nginx versions, but I've yet to see an official description
> of how we should achieve non-local logging. Preferably syslog,
> personally speaking, but anything scalable, supportable, debug-able
> and sane would, I feel, be acceptable to the wider community.
> 
> I'm aware of at least the following options, but I feel they're all
> lacking to some degree:
> 
> * log to local disk and syslog/logstash/rsync them off: undesirable
> due to the management overhead of the additional logging process/logic
> + the wasted disk I/O when creating the per-request logs

This is, actually, recommended solution.  It's main advantage is 
that nginx will continue to serve requests even if something 
really bad will happen with your "non-trivial infrastructure".  
Basically it will work till the server is alive.

[...]

> * use another 3rd-party logging protocol, e.g. statsd, redis: as
> similarly unsupportable as syslog patches

You may also take a look at Valery Kholodkov's udplog module,
http://grid.net.ru/nginx/udplog.en.html

I haven't actually used it (as I prefer local logging solution, 
see above), but I tend to like the basic concept behind the 
module.  At least it resolves the main problem with usual syslog 
interfaces (i.e. blocking).

Maxim Dounin