cis-nginx-v300-3-3

CIS 3.3 — Ensure error logging is enabled and set to the info logging level

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

The error_log directive configures logging for server errors and operational messages. Unlike access logs, error logs capture diagnostic information about failed requests, upstream connection issues, and configuration errors. The log level determines the verbosity of these messages and should be set to capture sufficient detail (typically notice or info) without overwhelming the storage system.

Rationale

While access logs capture incoming request patterns, error logs provide the internal system context required to diagnose why a request failed. They are essential for identifying:

1. Upstream Failures: Connection timeouts or refused connections to backend servers (e.g., application server is down).
2. Process Anomalies: Unexpected worker process terminations or restarts, which may indicate resource exhaustion or exploitation attempts.
3. Configuration Errors: Invalid request handling that NGINX rejects before logging to access logs (e.g., header size limits exceeded).

Without error logs, an administrator sees a "500 Internal Server Error" in the access log but has no way to determine the root cause.

Impact

Setting the log level to info (or even debug) can generate a significant volume of log data, especially on busy servers or during denial-of-service attacks. This increases disk I/O and storage requirements. Ensure that log rotation (e.g., via logrotate) is configured and storage usage is monitored to prevent disk exhaustion.

Audit Procedure

1. Verify Configuration:

Check the fully loaded configuration for error log settings:

nginx -T 2>/dev/null | grep -i "error_log"

Evaluation:

• Presence: Verify that error_log is defined globally in the main context (or http block).
• Destination: Ensure it points to a valid local file (e.g., /var/log/nginx/error.log) accessible for ingestion by log shippers.
• Level: Confirm the level is set according to your internal "Monitoring and Logging" policy.
• Fail: If error_log points to /dev/null or the level is set to crit, alert, or emerg (which suppresses too many relevant warnings).

Remediation

Configure the error_log directive in the main context (at the top of nginx.conf) to capture operational events.

Configuration Example:

# Log errors to a specific file with the 'notice' level
error_log /var/log/nginx/error.log notice;

http {
    # ...
}

Note: The specific logging level should be aligned with the organization's "Monitoring and Logging" Policy, balancing the need for forensic detail against storage and processing costs. Typically, info or notice is recommended.

Default Value

By default, NGINX logs errors to logs/error.log with the severity level error. This configuration misses warn, notice, and info events.

References

1. https://nginx.org/en/docs/ngx_core_module.html#error_log
2. https://docs.nginx.com/nginx/admin-guide/monitoring/logging/

Additional Information

Unlike access logs, NGINX Open Source uses a hardcoded text format for error logs and does not support custom log_format definitions (e.g., JSON, additional variables).

CIS Controls

MITRE ATT&CK Mappings

Profile

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer