Shell & DBA Ops

Nginx Access Log Analysis Guide

Use access logs to inspect status codes, latency, upstream behavior and suspicious traffic. Last updated September 1, 2026.

Use access logs to inspect status codes, latency, upstream behavior and suspicious traffic. This page is written as a practical engineering reference: it starts with evidence, keeps risky assumptions visible and links the next useful Formalint checks.

Use it when a ticket, incident or pull request needs a repeatable explanation rather than a quick guess. Keep secrets, customer data and production tokens out of browser tools and shared notes.

When this page is useful

• You need a small, shareable diagnostic sequence.
• You want to compare shell output, payload shape or parser behavior before changing code.
• You are preparing notes for another developer, DBA or support engineer.

Practical workflow

Command or pattern to start with

awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

Review checklist

1. Confirm the environment where the symptom happens.
2. Use a redacted sample that is still realistic enough to reproduce the behavior.
3. Keep request headers, payloads, logs and timestamps together.
4. Change one variable at a time so the result stays explainable.
5. Link the final note to a related Formalint reference for the next person.

Common mistake

The common trap is running the strongest command first instead of collecting read-only status and logs.

Formalint is strongest when it becomes part of the incident rhythm: reduce the sample, format the evidence, verify the assumption and only then change the system.

Related Formalint references

Continue with Linux Admin Command Guide, Docker Compose Debugging Guide, Nginx Reverse Proxy Checklist.

Frequently asked questions