cis-nginx-v300-3-1

name	cis-nginx-v300-3-1
description	Ensure detailed logging is enabled (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","logging"]
cis_id	3.1
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 3.1 — Ensure detailed logging is enabled

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

System logging must be configured to meet organizational security and privacy policies. Detailed logs provide the necessary context (event source, timestamp, user, network data) for incident response and forensic analysis. Modern logging strategies favor structured formats (JSON) over unstructured text to facilitate parsing by SIEM solutions.

Note: Sensitive information (e.g., session tokens, PII in query strings) should be excluded or masked in logs to prevent data leaks.

Rationale

Detailed logs are the foundation of effective incident response. CIS Control 8.5 ("Collect Detailed Audit Logs") recommends capturing event sources, dates, users, timestamps, and network addresses. Traditional text logs require complex, fragile Regex parsing that breaks easily when formats change. Structured logging (JSON) solves this by providing a self-describing format that is natively ingested by modern analysis tools (SIEM), ensuring that critical forensic data is always indexable and searchable.

Impact

Enabling detailed JSON logging increases the volume of log data. Ensure your log rotation policies (logrotate) and disk space monitoring are adjusted to handle the increased storage requirements.

Audit Procedure

1. Verify Log Format Configuration:

Inspect the log_format directives in your configuration:

nginx -T 2>/dev/null | grep -i "log_format"

Evaluation:

• Confirm that a detailed format (preferably JSON) is defined.
• Verify that the format includes critical fields: $time_iso8601, $remote_addr, $remote_user, $request, $status, $http_user_agent.

2. Verify Access Log Usage:

Check that the defined format is actually used by the access_log directive:

nginx -T 2>/dev/null | grep "access_log"

Evaluation:

• The access_log directive should reference the detailed format name (e.g., access_log /var/log/nginx/access.json main_access_json;).