What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use the broadest Nginx context that should share a logging policy, then override it in a server block only when a virtual host needs its own destination, format, retention or ownership boundary. Put a shared access_log in http; put per-site access and error logs in the relevant server block. Remember that access logging follows the location where request processing ends, especially after an internal redirect.
Readers deploying this configuration on a self-managed Linux VPS can use Antihost VPS, which provides full root access and NVMe storage.
As an Amazon Associate I earn from qualifying purchases.
How Nginx logging contexts work
Nginx configuration is hierarchical. The main context contains top-level directives; events and http are nested within it; server blocks are nested inside http; and location blocks are nested inside a server. A directive set at a broader supported level becomes the default for nested levels unless a narrower level changes it.
That hierarchy makes the choice straightforward: define a policy once at http when all virtual hosts should use the same file, format and collection method. Add a server-level directive when one virtual host requires separation. A server-level setting is an override, not a second global configuration.
#1 Best Overall
Do not treat access_log and error_log as interchangeable. They are separate directives implemented by different Nginx modules and have different valid contexts.
access_log and error_log: what each directive controls
Access logs
access_log records HTTP requests. Its valid contexts are http, server, location, if in location and limit_except. The documented default is logs/access.log combined; a relative path is interpreted under Nginx’s configured prefix.
An access-log declaration normally contains a destination and, optionally, a format:
access_log /var/log/nginx/access.log combined;The format must be declared with log_format in an allowed context, normally http. If you omit a format name, Nginx uses the default combined format where applicable.
Error logs
error_log records diagnostic messages generated by Nginx and related processing. It is valid in the main, http, mail, stream, server and location contexts. Its syntax includes a destination and an optional severity threshold:
error_log /var/log/nginx/example.error.log warn;Levels include debug, info, notice, warn, error, crit, alert and emerg. A lower threshold such as debug produces more messages; a higher threshold such as error records only more serious events.
Nginx permits several error logs on the same configuration level. If no file destination is explicitly defined at the main level, Nginx uses its default error-log file. Therefore, inspect the effective configuration rather than assuming that one filename mentioned in a nested block is the only destination.
Recommended Free Tools
Global http logging versus per-server logging
| Design | Isolation | Operational overhead | Retention and ownership | Troubleshooting | Central collection |
|---|---|---|---|---|---|
Shared http-level log |
All virtual hosts write to a common destination | One policy, one format and one rotation rule | Shared retention and access controls | Requires filtering by host, server name or request fields | Simple: forward one stream or file |
Per-server logs |
Each virtual host can have separate files or destinations | More declarations, files, permissions and rotation rules | Independent ownership, retention, billing or tenant boundaries | A site’s requests and failures are easier to isolate | Each destination must be collected and monitored |
| Mixed policy | Common default with selected server overrides | Central baseline plus exceptions to document | Separate handling only where justified | Usually the best balance for multiple sites | Shared or site-specific forwarding as required |
Choose the shared design when a central collector, common schema and uniform rotation policy matter more than file separation. Choose per-server logs when different customers, teams or applications need independent access, retention, incident response or accounting. A mixed design avoids copying the same directive into every server while still isolating sensitive or high-volume sites.
Pattern 1: one access log for every virtual host
Place the format and destination in the http block. Every nested server inherits the declaration unless it supplies another access_log.
http {
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log main;
server {
listen 80;
server_name example.com;
# Inherits the http-level access_log.
}
server {
listen 80;
server_name api.example.com;
# Also inherits the same destination and format.
}
}This arrangement gives all virtual hosts a common request schema. Include fields needed to distinguish hosts, such as $host or $server_name, when several domains share one file. The exact fields are a design choice; Nginx does not automatically create a separate file for each server.
Pattern 2: separate access and error logs for one server
Keep the common format in http, then override destinations in the virtual host that needs isolation.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemshttp {
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
server {
listen 80;
server_name example.com;
access_log /var/log/nginx/example.access.log main;
error_log /var/log/nginx/example.error.log warn;
}
}Other servers without overrides continue using the inherited http-level access policy and whatever error-log policy applies above them. This is useful when one site belongs to another team, has a different retention period, needs restricted file permissions or generates enough traffic to justify its own pipeline.
Create parent directories before reloading and ensure the Nginx worker user can open the files. A syntactically correct directive can still fail validation if its destination cannot be opened.
Pattern 3: a broad error policy with a narrower access policy
It is common to keep diagnostics centralized while separating request traffic. For example, define an error log at a broad level and an access log in http, then override only the access destination for selected servers. The two directives inherit independently; changing one does not automatically change the other.
error_log /var/log/nginx/error.log warn;
http {
access_log /var/log/nginx/access.log main;
server {
server_name example.com;
access_log /var/log/nginx/example.access.log main;
# Inherits the broad error_log unless overridden here.
}
}This split can reduce the number of diagnostic files while preserving per-site request accounting. If teams require independent error visibility as well, add a server-level error_log explicitly.
How to give every virtual host its own logs
For a site-by-site layout, repeat the destinations in each server block while keeping the format definition shared.
- Define the format once. Put
log_formatinsidehttp. - Create destinations and permissions. Make the parent directory and confirm the worker account can write the files. Decide whether a log-rotation tool will rotate each file separately.
- Add directives to each server. Use a unique access-log and error-log filename for every virtual host.
- Check the complete configuration. Run
nginx -Tto test and dump all loaded configuration files. Search the output for eachserver_name,access_loganderror_log. - Test syntax and file access. Run
nginx -t. Nginx checks syntax and attempts to open files referenced by the configuration. - Reload without stopping existing connections. Run
nginx -s reload. New workers use the new configuration while old workers shut down gracefully. - Generate a request and verify. Request the intended hostname, then check that the line appears in the expected file and that the error file remains writable.
Use absolute paths when practical. Relative paths such as logs/access.log depend on the Nginx prefix and can be surprising when packages and source builds use different prefixes.
Why a server block may appear to use the global log
The server has no override
If a server block contains no access_log, it inherits the nearest applicable declaration, commonly the one in http. The same inheritance principle applies to error_log across its supported contexts.
The request selected a different server
Nginx chooses a server according to the listening address, port and hostname matching rules. Verify the request’s Host value and the active server_name declarations. Testing by an IP address or an unexpected hostname can select the default server rather than the block you edited.
An internal redirect changed the final location
Access requests are logged in the context of the location where processing ends. That location may differ from the original one after an internal redirect. A rewrite, an error_page handoff or an application front controller can therefore make a request use the access-log settings of the final location.
When a request lands in an unexpected file, inspect every matching location and any rewrite or internal redirect. The effective logging context is the endpoint of processing, not necessarily the first location that matched.
The file is being rotated or collected elsewhere
Confirm the path shown by nginx -T, then check rotation configuration, symbolic links, container mounts and any external collector. A correctly configured Nginx process can write to a path that is renamed, mounted outside the host or immediately forwarded by another service.
Disabling or filtering access logs
Disable a server or location deliberately
The special off value disables access logging in that scope:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →server {
server_name health.example.com;
access_log off;
}You can also disable logging for a noisy endpoint with access_log off; inside its location. Use this only when losing request visibility is acceptable; health checks and static assets can be valuable during an incident.
Best Value
Log conditionally with if=
Conditional logging evaluates a variable and omits the request when the result is 0 or an empty string. A common status-based example is:
map $status $loggable {
~^[23] 0;
default 1;
}
http {
access_log /var/log/nginx/access.log combined if=$loggable;
}This example suppresses successful 2xx and redirection 3xx requests while retaining other statuses. Decide whether the lost baseline traffic is acceptable before using a filter; debugging a capacity or latency issue often requires the requests that a filter would discard.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controlling related error and subrequest messages
log_not_found controls whether errors about files that cannot be found are written to the error log. log_subrequest controls whether subrequests are written to the access log. Both directives are available in http, server and location contexts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set these at the broadest level that matches your policy, then narrow them for a site or endpoint with unusual noise. For example, suppressing expected missing-file messages for one static directory can keep the main error log useful, while enabling subrequest logging temporarily can reveal an authentication or internal-fetch problem.
Validation and troubleshooting checklist
- Dump what Nginx actually loaded:
nginx -Treveals included files, inherited declarations and duplicate destinations. - Test before reloading:
nginx -tcatches syntax errors and attempts to open configured log files. - Check directory permissions: the worker user needs permission to create or append to the selected files, and every parent directory must be searchable.
- Confirm the active binary and prefix: package-managed and source-built installations can use different configuration files and relative-path prefixes.
- Reload only after a successful test:
nginx -s reloadapplies the change while old workers finish existing requests. - Verify the selected virtual host: send a request with the intended hostname and port; an IP-only request may hit another server block.
- Trace internal redirects: inspect rewrites,
try_filesfallbacks anderror_pageprocessing when the final log differs from the initial location. - Check rotation and mounts: make sure the path has not been renamed, replaced, mounted into a container or redirected by a collector.
- Look for multiple error destinations: Nginx allows several error logs at one level, so an event may legitimately appear in more than one file.
Centralized logging with syslog
Nginx can send both access and error records to syslog instead of, or in addition to, local files. Destinations may be network addresses or UNIX-domain sockets. The documented forms include:
error_log syslog:server=192.168.1.1 debug;
access_log syslog:server=unix:/var/log/nginx.sock,nohostname;Use a network destination when several Nginx hosts feed a central collector, or a UNIX socket when the collector runs on the same machine. Define whether local files remain as a fallback, and secure the transport and socket permissions according to your environment.
Centralization reduces the need to inspect many hosts during an incident, but it does not remove the need for a clear schema, host identity and retention policy. If multiple virtual hosts share one stream, include fields that identify the request’s host or server so downstream searches can separate tenants.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallChoosing a design by operational requirement
Use one shared http-level destination when
- All sites have the same retention and access-control requirements.
- A central collector expects one consistent format.
- Operations prefers one rotation rule and one alerting pipeline.
- Host or server fields in the format are sufficient for filtering.
Override at server when
- A customer, team or compliance boundary requires separate files or permissions.
- Different virtual hosts need different retention periods.
- One application needs a distinct log format or verbosity.
- Incident responders need to isolate one site without filtering a very large shared file.
- Usage, billing or ownership reports must be generated per virtual host.
Use a mixed model when
- Most sites share a standard policy but a few require isolation.
- You want a central default while keeping exceptions explicit and reviewable.
- Some traffic goes to shared syslog and selected applications also retain local files.
Key limitations and expectations
Nginx documentation defines directive contexts and behavior but does not establish a universal performance, storage-cost or incident-frequency advantage for global versus per-server files. The right choice depends on traffic volume, retention, permissions, rotation, collection and the number of virtual hosts in your environment.
Whichever design you choose, document the inheritance deliberately. A future administrator should be able to tell which servers use the shared policy, which ones override it, where each file is rotated and whether an internal redirect can move a request into a different logging context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
