TMA-NGINX-3.3

Ensure error logging is enabled and set to the info logging level

보통레벨 1자동nginx

설명

The error_log directive configures logging for server errors and operational messages. Unlike access logs, error logs capture diagnostic information about failed requests, upstream connection issues, and configuration errors. The log level determines the verbosity of these messages and should be set to capture sufficient detail (typically notice or info) without overwhelming the storage system. error_log must be defined outside server/location blocks, and no error_log may point to /dev/null or use the crit, alert or emerg level. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

점검 방법

감사 방식: 셸 명령

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="error_log" && !inb("server") && !inb("location"){n++; f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} $1=="error_log" && (inb("server")||inb("location")) {f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set 'error_log /var/log/nginx/error.log info;' (or notice, per your logging policy) at the top of nginx.conf. Then run nginx -t and reload nginx.

속성

운영 체제: 모두
태그: nginxlogging
참고 자료: CIS NGINX Benchmark v3.0.0 - 3.3 Ensure error logging is enabled and set to the info logging level

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target nginx