Ensure access logging is enabled

MediumLevel 1Automatednginx

Description

The access_log directive enables the logging of client requests. While NGINX enables this by default, it allows granular control per server or location context. Based on enterprise requirements, the log should be enriched with relevant variables or converted to structured JSON format for modern SIEM integration. Refer to Recommendation 3.1 for detailed configuration of log formats and variables. Fails when access_log off is used outside a location block (in the http or a server context); location-level exclusions for static assets are allowed. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

How it is checked

Audit method: Shell command

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="access_log" && a(2)=="off" && !inb("location"){bad=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print bad?"noncompliant":"compliant"}'

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Replace 'access_log off;' at http/server level with 'access_log /var/log/nginx/access.log <format>;'. Then run nginx -t and reload nginx.

Properties

Operating systems: Any
Tags: nginxlogging
Reference: CIS NGINX Benchmark v3.0.0 - 3.2 Ensure access logging is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target nginx