Send Nginx access and error logs to stdout and stderr

In a Linux container, direct access logs to /dev/stdout and errors to stderr. The container runtime can then collect them for docker logs, Kubernetes logging, or a node-level collector.

Configure the streams directly

# Main context, outside http: includes server-wide errors.
error_log stderr warn;

http {
    access_log /dev/stdout combined;
}

This is a fragment for an existing configuration. combined is a predefined access-log format; a name such as main works only if you have defined that format. Review server and location overrides, because they may direct logs elsewhere. error_log /dev/stderr warn; is another common Linux form.

Keep existing file paths with symlinks

The official container image uses this pattern:

RUN ln -sf /dev/stdout /var/log/nginx/access.log \
 && ln -sf /dev/stderr /var/log/nginx/error.log

The configuration still names /var/log/nginx/access.log and error.log, but writes reach standard streams. A volume mounted over /var/log/nginx can hide those links; verify the resulting container filesystem.

Run Nginx in the foreground so the runtime can manage the main process:

CMD ["nginx", "-g", "daemon off;"]

Verify collection and retention

Send a test request and inspect the container's logs. Check both access records and error records in a test environment. Kubernetes collectors normally read the runtime's node-side log files; a write to stdout is not proof that a central platform has retained or parsed it.

Use the Guance Nginx integration to check the expected log fields and collection configuration. Keep container, namespace, and workload identity with the records.

Configure rotation and retention in the container runtime or logging system. Do not run ordinary file-based log rotation against the stdout/stderr symlinks. Log availability through docker logs also depends on the selected logging driver and its configuration.

FAQ

What if /dev/stdout produces a permission error?

Inspect the container user, file-descriptor targets, and runtime setup. On Linux, /proc/self/fd/1 may provide an alternative path to stdout, but it does not bypass underlying permissions or a closed descriptor. For errors, Nginx's special stderr destination avoids treating stderr as a regular pathname.

Can I write access logs to both a file and stdout?

Yes. Declare two access_log directives at the same configuration level. Each destination needs its own retention plan, and collecting both without deduplication can double-count requests.

References: access logging, error_log, official Nginx container.