What happened last night?
The site was slow and someone probed for secret files. Use the nginx access log to find out who, what and how often — and save a report for the team.
Know the log format
Log analysis like this is a real skill: after an incident, the team needs facts quickly, and a few well-chosen pipelines often answer in minutes what a dashboard can't show at all.
Before analysing a log, look at a few lines and name the fields. In nginx's default format, splitting on spaces makes $1 the client IP, $7 the requested path and $9 the status code. Write those positions down; every command in the report depends on them, and a wrong field number gives confident, wrong answers.
203.0.113.9 - - [10/Oct/2026:22:14:03 +0545] "GET /.env HTTP/1.1" 404 153 "-" "curl/8.4" # $1 $4 $6 $7 $8 $9 $10
head -3 access.log | awk '{ print $1, $7, $9 }' is a quick check that you picked the right fields.