Ensure error logging is enabled and set to the info logging level

СредњаНиво 1Аутоматскаnginx

Опис

The error_log directive configures logging for server errors and operational messages. Unlike access logs, error logs capture diagnostic information about failed requests, upstream connection issues, and configuration errors. The log level determines the verbosity of these messages and should be set to capture sufficient detail (typically notice or info) without overwhelming the storage system. error_log must be defined outside server/location blocks, and no error_log may point to /dev/null or use the crit, alert or emerg level. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Како се проверава

Метод провере: Команда љуске

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="error_log" && !inb("server") && !inb("location"){n++; f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} $1=="error_log" && (inb("server")||inb("location")) {f=a(2); l=a(3); if(f=="/dev/null"||l~/^(crit|alert|emerg)$/) bad=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Set 'error_log /var/log/nginx/error.log info;' (or notice, per your logging policy) at the top of nginx.conf. Then run nginx -t and reload nginx.

Својства

Оперативни системи: Било који
Ознаке: nginxlogging
Референца: CIS NGINX Benchmark v3.0.0 - 3.3 Ensure error logging is enabled and set to the info logging level

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target nginx