Configuring Logging and Monitoring

1. Setting Up Access Logs

Example: JSON access log format

log_format json_combined escape=json
  '{"ts":"$time_iso8601",'
  '"remote_addr":"$remote_addr",'
  '"method":"$request_method",'
  '"path":"$uri",'
  '"status":$status,'
  '"bytes":$body_bytes_sent,'
  '"rt":$request_time,'
  '"ua":"$http_user_agent",'
  '"req_id":"$request_id",'
  '"upstream_status":"$upstream_status"}';
access_log /var/log/nginx/access.json json_combined;

2. Configuring Error Logs

LevelUse
debugDev only
infoOperational events
noticeDefault prod
warnRecoverable
errorRequest failed
crit/alert/emergPage on-call

3. Implementing Structured Logging

FieldExample
tsISO 8601 UTC
levelinfo/warn/error
serviceapi-gateway
trace_idW3C trace ID
span_idW3C span
request_idPer-request UUID
user_idAuthenticated subject
routeMatched route name

4. Using Log Levels

EventLevel
2xx responseinfo / not logged
4xx responseinfo (per-request) or warn (rate)
5xx responseerror
Cert expiring < 14dwarn
Upstream all downcrit

5. Setting Up Request/Response Logging

Warning: Logging request/response bodies risks PII/secret exposure. Always redact, sample, or disable in prod.
StrategyDetail
Headers onlyDefault safe
Body sample 1%Debugging signal
Redact fieldspassword, token, ssn, card
Only on errors5xx only

6. Using Correlation IDs

Example: Correlation ID propagation

String requestId = request.getHeader("X-Request-Id");
if (requestId == null) requestId = UUID.randomUUID().toString();
MDC.put("request_id", requestId);
response.setHeader("X-Request-Id", requestId);
// Forward to upstream
upstreamRequest.setHeader("X-Request-Id", requestId);

7. Configuring Log Sampling

StrategyRate
All errors100%
Successful1-10%
Health checks0% (drop)
High-value endpoints100%
Per-traceSame decision as trace sampler

8. Implementing Log Filtering

FilterAction
Health check pathsDrop
Bot user agentsTag, separate stream
Secret patternsRedact sk_*, bearer
PII regexMask email, card

9. Setting Up Log Rotation

SettingRecommended
Rotate by size100 MB
Rotate by timeDaily
Compress oldgzip/zstd
Retention30-90 days local, 1y archive
Reload signalUSR1 (NGINX)

10. Configuring Audit Logs

EventFields
Auth success/failuser, ip, method, ts
Permission changeactor, target, before, after
Admin API callfull request body
Key rotationold hash, new hash, actor
StorageWORM (write-once), separate from app logs