NGINX combined access log
NGINX combined access log. HTTP requests in the configured combined format.
Source and collection
Configured service log destination; commonly under /var/log or the service data directory.
Record the exact log format directive, rotation policy, time zone and service version.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 603d747e6cbae640a79457d7d60fe848446f42dd68f1cfbd5c68cb11c52bf4da
67.43.156.13 - - [25/Oct/2016:14:49:33 +0200] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.59 Safari/537.36"
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
raw record | text |
- Timestamp
- May omit year or time zone depending on configuration.
- Message
- Parse according to the exact service format, preserving quoted request fields.
Investigation uses
- Compare URI, status, bytes, referer and user agent with upstream application logs.
- Preserve quoting, escaping and complete multiline records when applicable.
Validation boundaries
A proxy address may replace the original client; forwarded headers require an explicit trusted-proxy policy.
This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.