Disable logging does not seem to work.

General Discussion
1

In june my unimportant joomla websites got hacked because of the JCE funrability.
I fixed that, but when examining my logs I noticed a lot of http/1.1 activity was happening.
Even Microsoft , Google, Amazon and a lot of different addresses try to enter my websites.
I disabled port 80 and force 443 and in my servers I added

set $loggable 0;  # Default to not log

if ($is_http1) {
    set $loggable 0;  # Default to not log
    return 426;  # Upgrade required
}    
if ($http1_and_unknown) {
    return 426; # Upgrade Required
}
if ($server_protocol = "HTTP/1.1") {
    return 426;  # Upgrade Required
}    

# Log only successful requests
if ($status ~ ^[2]) {
    set $loggable 1;
}

Despite this, all my log’s still fill up with these 426 entries. I know the above 2 extra’s are unneeded, but…
Can anybody explain what I am doning wrong and why the 426 are still being logged to the access.log?

Thanks

2

Using sudo iptables -A INPUT -p tcp --dport 443 -j REJECT , stopped flooding my access.log and al my joomla websites stil worked perfectly, except my 3 Nextcloud test servers they refused to connect. Removing the rule resolved this, but then…
As I said, my websites are not important, but finding status 200, normal completion, between all those 426 is a PITA :wink:
If I just could prevent them from being logged then…

3

It appears that my own server rules, for detecting http/1.1 traffic was causing the flood of 426 status codes in the access.log’s. I removed them and indeed no more 426 status codes.
Still the question remains why did they not stop logging despite my set $loggable 0; # Default to not log?

4

Hi there,

I don’t have the answer; but most of the $variables that you have shown in your config, are not special to nginx. So they will only “do” things if you have other config that uses them.

For example – the “$loggable” might be being used in the “if=” part of an “access_log” directive somewhere? (Module ngx_http_log_module).

$server_protocol is special – Module ngx_http_core_module – but (in general) I’m not sure why you should care if it is http 1.1 or 2.0 or something else. It is (mostly) unrelated to whether or not https is used, or which ssl_protocol is used; they are things that it seems reasonable to “require” an upgrade from. You may well have a good reason for wanting that, of course.

The “access_log” example shows setting $loggable with a “map” – I do not know what happens if you have that, and also use “set” to change the value.

Depending on the overall desire, perhaps “just” using the “map” to set 426 not-loggable; or to set ~ ^2 loggable; without any explicit “set” directives, could show you what you want?

Good luck with it,