Getting Started

Nginx website

Prepare Nginx request logs and install the Honeylog sender.

Use this guide when the website runs on Nginx. The installation requires access to the server terminal and Nginx configuration. If you do not manage those areas yourself, send this guide together with the private Honeylog installation page to your hosting provider or server administrator.

#Before you begin

The person completing the installation must be able to edit the Nginx configuration, run commands with administrator permissions, and reload Nginx. They also need the ingestion secret shown in Honeylog under Settings > Installation > Nginx.

#Step 1: Prepare Nginx to record visits

  1. In Honeylog, open the website, go to Settings > Installation, and choose Nginx.
  2. Copy the Nginx log format below without changing the order of its fields.
  3. Add log_format inside the http section of the Nginx configuration.
  4. Add access_log inside the server section used by this website.
  5. Run the configuration check. Continue only if Nginx reports that the test was successful.
  6. Reload Nginx.

This configuration creates /var/log/nginx/honeylog_access.log, the file used by the Honeylog sender. If the website must use a different location, change the path here and use the same path in the Honeylog installation page.

Nginx log format:

log_format honeylog '$remote_addr $http_x_forwarded_for - $remote_user [$time_local] '
                    '"$host" "$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" "$http_x_requested_with" '
                    '"$http_accept_language" "$http_sec_fetch_dest" "$http_sec_fetch_mode" '
                    '"$http_sec_fetch_site" "$http_sec_fetch_user" "$http_sec_purpose" '
                    '"$http_purpose" "$http_x_moz" "$http_sec_speculation_tags" '
                    '$request_length $bytes_sent $request_time';

access_log /var/log/nginx/honeylog_access.log honeylog;

Validate and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

After the reload, open a public page on the website and confirm that Nginx adds a new line to /var/log/nginx/honeylog_access.log. That confirms the log is ready for the sender.

#Step 2: Install the Honeylog sender

  1. In the private Honeylog installation page, save the correct website address and log file path.
  2. Copy the generated install command and run it in the server terminal.
  3. When the terminal asks for the Honeylog ingestion secret, paste the secret shown on the installation page and press Enter. The secret is hidden while you type.
  4. Wait for the command to finish without errors.

Install script:

Open install.sh

Install command:

The public example below uses SITE_DOMAIN as a placeholder. Run the personalized command shown under Settings > Installation > Nginx in Honeylog.

read -rsp "Honeylog ingestion secret: " HONEYLOG_INGESTION_SECRET
echo
export HONEYLOG_INGESTION_SECRET
export CLIENT_BASE_URL='https://api.honeylog.io/clients'
export HONEYLOG_API_URL='https://api.honeylog.io/events'
export HONEYLOG_SITE_DOMAIN='SITE_DOMAIN'
export HONEYLOG_LOG_PATH='/var/log/nginx/honeylog_access.log'
export HONEYLOG_SITE_SCHEME='https'
export HONEYLOG_EVENT_NAME='pageview'
export HONEYLOG_SKIP_PATH_REGEX='\.(?:css|js|mjs|map|png|jpe?g|gif|svg|ico|webp|avif|woff2?|ttf|eot|otf|xml|txt)$'
export HONEYLOG_BATCH_SIZE='100'
export HONEYLOG_TIMEOUT_MS='10000'
export HONEYLOG_POLL_INTERVAL_SECONDS='30'
export HONEYLOG_LOG_MAX_SIZE='100M'
export HONEYLOG_LOG_ROTATE_COUNT='14'
curl -fsSL "$CLIENT_BASE_URL/nginx/install.sh" | bash

#Step 3: Verify the installation

Run the following commands on the server:

sudo systemctl status honeylog-nginx.service --no-pager
sudo journalctl -u honeylog-nginx.service -n 100 --no-pager

The service status should show active (running). Then open a few public pages on the website, wait about one minute, and confirm that the visits appear in Honeylog. If the service is not active or the visits do not appear, send the command output to the person responsible for the server or to Honeylog support.