How to Find and Review Nginx and Apache Access Logs
Summary
A practical guide to locating and exporting Nginx and Apache logs on Linux and in containers, accounting for rotation and proxies, and reviewing request patterns that may indicate scanning or exploitation.
Key points
- On Debian and Ubuntu, Nginx and Apache logs are typically under /var/log/nginx and /var/log/apache2; RHEL-based Apache commonly uses /var/log/httpd.
- Check effective server and virtual-host configuration for custom log paths and formats; Debian-based Apache may also log virtual hosts to other_vhosts_access.log.
- Containerized Nginx may send access and error logs to stdout and stderr; Docker and Kubernetes log commands can export them.
- Include rotated logs when reviewing activity, and collect error logs alongside access logs for additional context.
- Behind a proxy or load balancer, requests may show the proxy's IP unless real-client logging is configured; forwarded headers or proxy logs may contain the client address.
- Repeated requests for sensitive paths, exploit-like strings, suspicious POSTs, or unusual user agents can indicate scanning or attempted exploitation, but require investigation.
- Review log sanitization before uploading logs because query strings may contain session tokens.
Article Details
- Defense Focus
- Locate, export, and review web-server access and error logs to detect scanning, exploit attempts, and possible web-shell activity.
- Detection Methods
- Look for bursts of 404 requests targeting paths such as /.env, /.git/config, /wp-login.php, and /phpmyadmin.
- Search request URLs for traversal strings, ${jndi:, SQL-injection patterns such as union select, and script tags.
- Investigate successful POST requests to unusual files in upload directories, including other requests made by the same IP.
- Identify user agents such as sqlmap, nikto, and nuclei.
- Correlate spikes in 5xx responses with unusual preceding requests.
- Review access and error logs together; check proxy logs or logged X-Forwarded-For values when requests appear to originate from a proxy.
- Data Sources
- Nginx access and error logs, including rotated files
- Apache access and error logs, including virtual-host logs and rotated files
- Container stdout and stderr logs
- Proxy or load-balancer logs
- X-Forwarded-For values, when logged
- Cluster log-collector data when a pod has been replaced
- Rule Types
- Web-server log detection rules
- Log-pattern detections for scanning and exploit attempts
- Access/error-log correlation
- Platforms
- Linux web-server hosts
- Containerized deployments
- Kubernetes deployments
- Centralized log collectors
- Defensive Actions
- Confirm effective access-log and error-log paths from the server configuration, including custom virtual-host paths.
- Include rotated logs when exporting; use zcat -f to read plain and compressed files.
- Collect both access and error logs for the same time period.
- For containerized servers, export stdout and stderr logs and check the cluster log collector if a pod was replaced.
- Verify whether real client IP logging is configured behind a proxy; consult proxy logs or X-Forwarded-For when appropriate.
- Check the configured log format before uploading or parsing logs.
- Review sanitized log contents before proceeding, since query strings may contain session tokens.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe article says Prime Core web-server-log rules cover exploitation of public-facing applications and recommends searching logs for exploit attempts.T1505.003 · Web ShellThe article identifies possible web shells from successful POSTs to unusual files under upload directories.T1595.002 · Vulnerability ScanningThe article says Prime Core rules cover vulnerability scanning and describes detecting automated scans through bursts of requests for common sensitive paths.
Products
ApacheOn Debian and Ubuntu, Nginx logs to /var/log/nginx/access.log and error.log, and Apache to /var/log/apache2/access.log and error.log.DockerIn containers built from the official Nginx image, there are no log files at all: everything goes to stdout and stderr, so docker logs is your export.LogTotalUpload, sanitize and review in LogTotalNGINXOn Debian and Ubuntu, Nginx logs to /var/log/nginx/access.log and error.log, and Apache to /var/log/apache2/access.log and error.log.Prime CorePrime Core has 812 detection rules for web server logs, mapped to 337 MITRE ATT&CK techniques.