Disable nginx access log (to remote syslog server)

arrmo

Hi,

I have pfSense set up to send syslog information to a remote syslog server - in general it's working fine, no issues. But ... nginx is sending a LOT of traffic across (e.g. ~ 2400 messages in 2 hours), and this is all just for accesses (i.e. access log). I'd like to disable this particular item, and I think the file I need to mess with is /var/etc/syslog.d/pfSense.conf ... but I admit, I'm not real familiar with the syntax of this file. Has anyone had any luck configuring this?

Thanks in advance for any pointers!

Gertjan

True, these "access logs" are not really needed and do pollute de remote log.

@arrmo said in Disable nginx access log (to remote syslog server):

/var/etc/syslog.d/pfSense.conf

Noop.
This is the one that controls syslogd : /etc/syslog.conf
It's build here 985 -> 1080 in /etc/inc/system.inc

I tried to rebuild somewhat the last statement :
Mine is :

*.* 								@192.168.1.4

so it excludes logs from 'nginx' as a program, or "Local5" as the facility, but no access.

It's also possible to inform nginx to shut up. See line 1447 :

	access_log      syslog:server=unix:/var/run/log,facility=local5 combined;

in the same system.inc file.

What somewhat seem to work without any pfSense file edits :

Another solution : On the remote site, filter out Local5.Info messages

arrmo

@Gertjan said in Disable nginx access log (to remote syslog server):

True, these "access logs" are not really needed and do pollute de remote log.

@arrmo said in Disable nginx access log (to remote syslog server):

/var/etc/syslog.d/pfSense.conf

Noop.
This is the one that controls syslogd : /etc/syslog.conf

Yes, agree with you! I was thinking filtering at syslog, but I like your idea better

It's build here 985 -> 1080 in /etc/inc/system.inc

I tried to rebuild somewhat the last statement :
Mine is :
*.* 								@192.168.1.4
so it excludes logs from 'nginx' as a program, or "Local5" as the facility, but no access.

OK, you lost me there, sorry. With *.* ... everything gets sent across, no? I may be missing your point.

It's also possible to inform nginx to shut up. See line 1447 :
	access_log      syslog:server=unix:/var/run/log,facility=local5 combined;
in the same system.inc file.

What somewhat seem to work without any pfSense file edits :

Yes, agreed! I like this approach. I changed that line to ,

access_log off;

And voila, after a webConfigurator restart (to regenerate the needed files) ... no "noise" from the access log. I think this is the best way to go, agreed?

Another solution : On the remote site, filter out Local5.Info messages

Right, but that still means all those messages going across => lots of bandwidth and horsepower chewed up (for no good reason ... agreed?)

Thanks for the thoughts and pointers - much appreciated!