Ensure detailed logging is enabled

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

1. Verify Log Format Configuration: Inspect the log_format directives in your configuration: nginx -T 2>/dev/null | grep -i "log_format" Evaluation: Confirm that a detailed format (preferably JSON) is defined. Verify that the format includes critical fields: $time_iso8601, $remote_addr, $remote_user, $request, $status, $http_user_agent. 2. Verify Access Log Usage: Check that the defined format is actually used by the access_log directive: nginx -T 2>/dev/null | grep "access_log" Evaluation ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Define a detailed log format in the http block of /etc/nginx/nginx.conf. It is highly recommended to use JSON format for compatibility with modern SIEM tools. Recommended Configuration (JSON): http { log_format main_access_json escape=json '{' '"timestamp": "$time_iso8601",' '"remote_addr": "$remote_addr",' '"remote_user": "$remote_user",' '"server_name": "$server_name",' '"request_method": "$request_method",' '"request_uri": "$request_uri",' '"status": $status,' '"body_bytes_sent": $body_bytes_sent,' '"http_referer": "$http_referer",' '"http_user_agent": "$http_user_agent",' '"x_forwarded_for": "$http_x_forwarded_for",' '"request_id": "$request_id"' '}'; # Apply the format globally or per server access_log /var/log/nginx/access.json main_access_json; } Legacy Configuration (Text-based): If JSON is not feasible, ensure the text format captures all necessary fields ...