This project is a proof of concept demonstrating how to intercept and duplicate NGINX logs at will within a live NGINX container.
The goal is to showcase techniques for tapping into NGINX log streams, allowing you to observe, intercept, and duplicate log entries in real time.
- The project is designed to run inside a live NGINX container.
- It demonstrates how to hook into NGINX log output, enabling duplication or interception of log entries as they are generated by the server.
- The approach is flexible and can be adapted to various use cases, such as log aggregation, analytics, or real-time monitoring.
This is an experimental proof of concept. It is not intended for production use. Use at your own risk.
-
Build and run the container as described in the
Dockerfile.
docker build . -t nginx-log-tap
docker run --rm --name example-nginx -p 8080:80 nginx-log-tap -
In another terminal, exec nginx-log-tap
docker exec example-nginx nginx-log-tap -
In another terminal run curl, check capture log
➜ curl -I localhost:8080
HTTP/1.1 200 OK
Server: nginx/1.29.1
Date: Mon, 15 Sep 2025 13:16:45 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Wed, 13 Aug 2025 15:10:24 GMT
Connection: keep-alive
ETag: "689caae0-267"
Accept-Ranges: bytes
➜ docker exec example-nginx cat /tmp/access_captured.log
192.168.65.1 - - [15/Sep/2025:13:16:45 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/8.7.1" "-"
- The result has the curl request logged both to
stdout(visible from the first terminal), and duplicated in/tmp/access_captured.log