Reading nginx logs: five patterns worth a second look

Access logs look like noise until you know what to look for. These are five patterns worth a second look when you scan a day of traffic.

1. A sudden rise in 404 responses for paths that never existed. Usually a scanner walking a list of common admin panels and backup files. Harmless unless one of those paths actually answers.
2. Many requests from one address at a very regular interval. Real visitors are irregular; a metronome is a script.
3. Status 499. The client closed the connection before the answer arrived, which often points at a slow upstream rather than at the client.
4. Large responses for small pages. A page that should be a few kilobytes but transfers megabytes usually has an unoptimised image or a missing compression setting.
5. Empty or unusual user agents hitting your API paths.

None of these is an incident on its own. The point is to know your normal baseline, so that a change stands out. A simple daily summary of the top paths, top status codes and top addresses is often enough.