Ensure error logging is enabled and set to the info logging level

MoyenneNiveau 1Automatiséenginx

Description

The error_log directive configures logging for server errors and operational messages. Unlike access logs, error logs capture diagnostic information about failed requests, upstream connection issues, and configuration errors. The log level determines the verbosity of these messages and should be set to capture sufficient detail (typically notice or info) without overwhelming the storage system. error_log must be defined outside server/location blocks, and no error_log may point to /dev/null or use the crit, alert or emerg level. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="error_log" && !inb("server") && !inb("location"){n++; f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} $1=="error_log" && (inb("server")||inb("location")) {f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Set 'error_log /var/log/nginx/error.log info;' (or notice, per your logging policy) at the top of nginx.conf. Then run nginx -t and reload nginx.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: nginxlogging
Référence: CIS NGINX Benchmark v3.0.0 - 3.3 Ensure error logging is enabled and set to the info logging level

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target nginx