Log Files

Location and management of Nginx, PHP-FPM, MariaDB, and system log files.

Overview

This page lists the log file locations for all major Centmin Mod components. Also see FAQ item #19 and the full Configuration Files reference for related information.

Nginx Log Files

Main Nginx Logs

Log Type Location
Error Log /var/log/nginx/error.log
Access Log /var/log/nginx/access.log
Default localhost Error /var/log/nginx/localhost.error.log
Default localhost Access /var/log/nginx/localhost.access.log
Centmin Mod Main Error Log /usr/local/nginx/logs/error.log
Centmin Mod Main Access Log /usr/local/nginx/logs/access.log

Centmin Mod Nginx log paths: The main Nginx error log is at /usr/local/nginx/logs/error.log and the main access log is at /usr/local/nginx/logs/access.log. Per-vhost logs are in /home/nginx/domains/yourdomain.com/log/ with separate access.log and error.log files per domain.

Per-Vhost Nginx Logs

Each Nginx vhost domain has its own dedicated log directory:

/home/nginx/domains/domain.com/log/access.log
/home/nginx/domains/domain.com/log/error.log

For more information on Nginx configuration, see the Nginx documentation page. If running behind Cloudflare, see Cloudflare Custom Logging for capturing CF-specific headers.

PHP-FPM Log Files

Log Type Location
PHP-FPM Error Log /var/log/php-fpm/www-error.log
PHP-FPM Slow Log /var/log/php-fpm/www-slow.log
PHP-FPM Main Log /var/log/php-fpm/php-fpm.log
Centmin Mod PHP Logs /home/nginx/domains/domain.com/log/php_slow_log.log

The PHP-FPM slow log records requests that exceed the configured request_slowlog_timeout threshold. This is useful for identifying slow PHP scripts. See the PHP-FPM documentation for configuration details.

MariaDB MySQL Log Files

Log Type Location
MariaDB Error Log /var/log/mysqld.log
MariaDB Slow Query Log /var/log/mysqld-slow.log
MariaDB Data Directory /var/lib/mysql/

For MariaDB configuration and management, see the MariaDB MySQL documentation.

Pure-FTPD Log Files

Log Type Location
Pure-FTPD Log /var/log/pureftpd.log
System Log (fallback) /var/log/messages (filter with grep pure-ftpd)

CSF Firewall Log Files

Log Type Location
LFD (Login Failure Daemon) /var/log/lfd.log
iptables/Firewall Log /var/log/messages

System Log Files

Log Type Location
System Messages /var/log/messages
Kernel Log /var/log/dmesg
Secure/Auth Log /var/log/secure
Cron Log /var/log/cron
YUM Package Manager /var/log/yum.log

Centmin Mod Logs

Log Type Location
Centmin Mod Install Log /root/centminlogs/
centmin.sh Menu Log /root/centminlogs/centminmod_menuopt_*.log

Viewing Log Files

Common commands for viewing and monitoring log files:

View Last N Lines

# View last 25 lines of Nginx error log
tail -25 /var/log/nginx/error.log

# View last 50 lines of PHP-FPM error log
tail -50 /var/log/php-fpm/www-error.log

# View last 25 lines of MariaDB error log
tail -25 /var/log/mysqld.log

Follow Logs in Real Time

# Follow Nginx error log in real time (Ctrl+C to stop)
tail -f /var/log/nginx/error.log

# Follow multiple logs simultaneously
tail -f /var/log/nginx/error.log /var/log/php-fpm/www-error.log

Search Logs

# Search for error patterns in Nginx logs
grep "error" /var/log/nginx/error.log

# Search Pure-FTPD entries in system log
grep pure-ftpd /var/log/messages | tail -25

# Search for 500 errors in vhost access log
grep " 500 " /home/nginx/domains/domain.com/log/access.log

Processing Compressed (Rotated) Logs

Centmin Mod’s logrotate configuration compresses older log files with gzip (creating .gz files). Use zcat to read compressed logs without extracting them, or pzcat (from the pigz package) for multi-core parallel decompression that is significantly faster on large log files.

# Read a compressed log file with zcat
zcat /var/log/nginx/access.log-20260301.gz

# Use pzcat for faster multi-core decompression (pigz)
pzcat /var/log/nginx/access.log-20260301.gz

# Pipe compressed logs through analysis pipelines
zcat /home/nginx/domains/domain.com/log/access.log.*.gz | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# Search across all rotated logs for a specific IP
zcat /var/log/nginx/access.log.*.gz | grep "192.168.1.100"

# Count 404 errors across all compressed access logs
zcat /home/nginx/domains/domain.com/log/access.log.*.gz | grep '" 404 ' | wc -l

The pzcat command uses all available CPU cores for decompression, making it noticeably faster than single-threaded zcat when processing large or multiple compressed log files. Install pigz via yum -y install pigz if not already present (Centmin Mod installs pigz by default).

For more details and discussion, see the community forum thread.

Log Rotation

Centmin Mod configures logrotate for all major services to prevent log files from consuming excessive disk space. Rotated logs are compressed and retained for a configurable number of days.

Logrotate Configuration Files

/etc/logrotate.d/nginx
/etc/logrotate.d/php-fpm
/etc/logrotate.d/mysql
/etc/logrotate.d/pureftpd

Rotated log files are compressed with gzip and typically have the .gz extension. Use zcat or zgrep to read them without manually decompressing.