separate logs from limit_req_zone in nginx

Question

Here we have piece of current nginx configuration:

limit_req_zone $binary_remote_addr zone=one:32m rate=2r/s;
limit_req zone=one burst=10;
error_page 500 501 502 503 504 =503 /offline.html;
location = /offline.html {
                root /path/to;
                add_header Cache-Control no-cache;
                add_header Retry-After 3600;
        }

Is there any way to separate "triggering" limit_req zone (which causes error code 503, that can be caused by apache backend too, for example) to another log file (rather default /var/log/nginx/error.log).

Yes, there is new feature in 1.3.15

limit_req_status xxx;

But it was implemented few days ago in trunc branch, and seems cant help too much. Or i missing something? Having nginx 1.2.7 atm.

score 0 · Answer 1 · answered Mar 23 '13 at 18:39

I don't see how limit_req_status is related to your question at all — it is not.

You could try accomplishing what you need with the following directives:

http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_log_level

http://nginx.org/en/docs/ngx_core_module.html#error_log

You'd bump up the log_level for the limit requests, and would specify the desired log level with error_log. Note that it would likely drop other error messages if you do this. If that happens, and the effect is undesired, then you might try having two error_log directives at the same level (e.g. within the same location), with different log levels.

score 0 · Accepted Answer · answered Mar 26 '13 at 09:05

I've made some like that:

limit_req_zone $binary_remote_addr zone=one:32m rate=2r/s;

error_page 500 501 502 504 =503 @offline50x;
error_page 503 =503 @offline503;
error_page 404 =503 @offline404;

server {
        listen 80;

        root /usr/share/nginx/html;
        index index.html index.htm;

        server_name localhost;

        location / {
                limit_req zone=one burst=10;
        }

        location @offline404 {
                access_log /tmp/404;
                try_files /offline.html =503;
        }

        location @offline50x {
                access_log /tmp/50x;
                try_files /offline.html =503;
        }

        location @offline503 {
                access_log /tmp/ddos;
                try_files /offline.html =503;
        }

Looks like 503 generated by limit_req. So when feature

limit_req_status xxx;

will be implemented in stable it gonna be more easyer to separate this kind of errors to separate file.

separate logs from limit_req_zone in nginx

2 Answers2