TMA-NGINX-3.3
Ensure error logging is enabled and set to the info logging level
Descripción
The error_log directive configures logging for server errors and operational messages. Unlike access logs, error logs capture diagnostic information about failed requests, upstream connection issues, and configuration errors. The log level determines the verbosity of these messages and should be set to capture sufficient detail (typically notice or info) without overwhelming the storage system. error_log must be defined outside server/location blocks, and no error_log may point to /dev/null or use the crit, alert or emerg level. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.
Cómo se verifica
Método de auditoría: Comando de shell
out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i, x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n, i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="error_log" && !inb("server") && !inb("location"){n++; f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} $1=="error_log" && (inb("server")||inb("location")) {f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad)?"compliant":"noncompliant"}'- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Set 'error_log /var/log/nginx/error.log info;' (or notice, per your logging policy) at the top of nginx.conf. Then run nginx -t and reload nginx.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- nginxlogging
- Referencia
- CIS NGINX Benchmark v3.0.0 - 3.3 Ensure error logging is enabled and set to the info logging level
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target nginx