Opened 14 months ago
Closed 14 months ago
#2549 closed defect (duplicate)
Nginx output to error.log file stops after encountering a special character in the request
Reported by: | Owned by: | ||
---|---|---|---|
Priority: | minor | Milestone: | |
Component: | nginx-module | Version: | 1.22.x |
Keywords: | logging | Cc: | |
uname -a: | Linux iwgdhvrtgl 5.14.0-325.el9.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jun 9 19:47:16 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux | ||
nginx -V: |
nginx version: nginx/1.22.1
built by gcc 11.3.1 20221121 (Red Hat 11.3.1-4) (GCC) built with OpenSSL 3.0.7 1 Nov 2022 TLS SNI support enabled configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-openssl-opt=enable-ktls --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads --with-cc-opt='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=x86-64-v2 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' --with-ld-opt='-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,-E' |
Description (last modified by )
Hello,
Nginx stops writing into error.log for the day after encountering some particular special character[s], e.g.:
2023/10/11 14:36:16 [warn] 184750#184750: *754 using uninitialized "domlogging" variable while logging request, client: 91.245.37.125, server: [...].com, request: "
(The final character here is an invisible space, not sure if this form can deliver it, just in case attach a screenshot from Brackets editor which displays special characters as red circles – https://i.imgur.com/j6XzKbT.png).
The error.log file time keeps getting updated after an entry like that (apparently from attempts to write...), however there is no more logging.
Restarting Nginx on the same day does not help, only restarting on the next day when the there's a newer error.log file works (until that special character line happens again).
For comparison, some other special characters do not break the log, example:
2023/10/11 14:15:47 [warn] 184750#184750: *351 using uninitialized "domlogging" variable while logging request, client: 64.227.138.197, server: [...].com, request: "zùÂÃòai¦¸fz¥_"
(Screenshot – https://i.imgur.com/3eZs881.png)
Server configuration related to "domlogging" is:
map $remote_addr $log_ip { "128.69.152.187" 0; "63.143.42.248" 0; "100.43.81.130" 0; "63.143.42.251" 0; "95.26.221.246" 0; default 1; } map $http_user_agent $log_bua { ~CloudFlare 0; ~Googlebot 0; ~YandexBot 0; ~bingbot 0; ~Baiduspider 0; ~UptimeRobot 0; ~YandexTurbo 0; default 1; } ..... set $domlogging 1; if ( $log_bua = 0 ) { set $domlogging 0; } if ( $log_ip = 0 ) { set $domlogging 0; } access_log /var/log/nginx/[...].log [...] if=$domlogging;
Change History (4)
comment:1 by , 14 months ago
comment:2 by , 14 months ago
Hello,
that seems to be the case indeed, the file can be read with any non-formatting editor, apologies for the pointless ticket.
comment:3 by , 14 months ago
Description: | modified (diff) |
---|
comment:4 by , 14 months ago
Resolution: | → duplicate |
---|---|
Status: | new → closed |
Thanks for confirming, closing this as a duplicate of #191.
From the description it looks like your editor breaks on certain characters, and stop displaying anything after the character (and nginx indeed can log anything to the error log, see #191). Could you please check if the log file size, as shown by
ls
, is properly updated? Also, could you please try checking file contents with some other viewer, such asless
?