Information
System logging should be configured to meet your organizational security and privacy policies. Enabling detailed logging to include information about events, event sources, timestamps, and users may assist in incident response activities.
NOTE: Aim to keep sensitive information out of logs. For example, keep sensitive information out of query strings and URIs to avoid this.
Rationale:
Performing detailed logging ensures that incident responders, auditors, and others are able to clearly view the activity that has occurred on your server.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Edit the log format directive in /etc/nginx/nginx.conf so it logs everything needed to meet your organizational policies.
The following variables may be considered as useful examples include in your log_format with descriptive logging. You should consult the NGINX documentation and your organizational policy to ensure you are logging sufficient information and removing sensitive information where needed.
$remote_addr - client address
$remote_user - the user if basic authentication is used
$status - the HTTP response status
$content_type - Content-Type request header field
$time_local - local time in the Common Log Format
$request_method - request method, usually GET or POST
$request - full original request line
$uri - normalized URI in request
$server_port - port of the server which accepted a request
$server_name - name of the server which accepted a request
$http_user_agent - user agent of the client requesting access
$http_x_forwarded_for - client address a proxy or load balancer is forwarding traffic for