Opened 8 months ago

Closed 8 months ago

#2549 closed defect (duplicate)

Nginx output to error.log file stops after encountering a special character in the request

Reported by: doyoumoo@… Owned by:
Priority: minor Milestone:
Component: nginx-module Version: 1.22.x
Keywords: logging Cc:
uname -a: Linux iwgdhvrtgl 5.14.0-325.el9.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jun 9 19:47:16 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.22.1
built by gcc 11.3.1 20221121 (Red Hat 11.3.1-4) (GCC)
built with OpenSSL 3.0.7 1 Nov 2022
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-openssl-opt=enable-ktls --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads --with-cc-opt='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=x86-64-v2 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' --with-ld-opt='-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,-E'

Description (last modified by doyoumoo@…)

Hello,

Nginx stops writing into error.log for the day after encountering some particular special character[s], e.g.:

2023/10/11 14:36:16 [warn] 184750#184750: *754 using uninitialized "domlogging" variable while logging request, client: 91.245.37.125, server: [...].com, request: "

(The final character here is an invisible space, not sure if this form can deliver it, just in case attach a screenshot from Brackets editor which displays special characters as red circles – https://i.imgur.com/j6XzKbT.png).

The error.log file time keeps getting updated after an entry like that (apparently from attempts to write...), however there is no more logging.

Restarting Nginx on the same day does not help, only restarting on the next day when the there's a newer error.log file works (until that special character line happens again).

For comparison, some other special characters do not break the log, example:

2023/10/11 14:15:47 [warn] 184750#184750: *351 using uninitialized "domlogging" variable while logging request, client: 64.227.138.197, server: [...].com, request: "zùÂÃòai¦¸fz¥_"

(Screenshot – https://i.imgur.com/3eZs881.png)

Server configuration related to "domlogging" is:

map $remote_addr $log_ip {
    "128.69.152.187" 0;
    "63.143.42.248" 0;
    "100.43.81.130" 0;
    "63.143.42.251" 0;
    "95.26.221.246" 0;
    default 1;
}
map $http_user_agent $log_bua {
    ~CloudFlare 0;
    ~Googlebot 0;
    ~YandexBot 0;
    ~bingbot 0;
    ~Baiduspider 0;
    ~UptimeRobot 0;
    ~YandexTurbo 0;
    default 1;
}

.....

    set $domlogging 1;
    if ( $log_bua = 0 ) {
        set $domlogging 0;
    }
    if ( $log_ip = 0 ) {
        set $domlogging 0;
    }

access_log /var/log/nginx/[...].log [...] if=$domlogging;

Change History (4)

comment:1 by Maxim Dounin, 8 months ago

From the description it looks like your editor breaks on certain characters, and stop displaying anything after the character (and nginx indeed can log anything to the error log, see #191). Could you please check if the log file size, as shown by ls, is properly updated? Also, could you please try checking file contents with some other viewer, such as less?

comment:2 by doyoumoo@…, 8 months ago

Hello,
that seems to be the case indeed, the file can be read with any non-formatting editor, apologies for the pointless ticket.

comment:3 by doyoumoo@…, 8 months ago

Description: modified (diff)

comment:4 by Maxim Dounin, 8 months ago

Resolution: duplicate
Status: newclosed

Thanks for confirming, closing this as a duplicate of #191.

Note: See TracTickets for help on using tickets.