Data Source: Nginx Error Log

Created: 2026-10-22

Last Updated: 2026-10-22

ID: 3c43a18f-738b-4d0f-b885-f66580b2bf77

Author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Raven Tait, Splunk

Description

Nginx error log events including severity, process and thread identifiers, client address, server, request, and error message details.

Details

Property	Value
Source	`/var/log/nginx/error.log`
Sourcetype	`nginx:plus:error`

Name ▲▼	Technique ▲▼	Type ▲▼
PHP Memory Exhaustion Exploitation Attempt via Multipart Request	Exploit Public-Facing Application	Anomaly

Supported Apps

Splunk Add-on for NGINX (version 3.3.2)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">client</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">message</span>
  
  <span class="pill kill-chain">pid</span>
  
  <span class="pill kill-chain">request</span>
  
  <span class="pill kill-chain">server</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">tid</span>
  
</div>

Example Log

12026/10/22 13:58:58 [error] 199705#199705: *2052 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Allowed memory size of 33554432 bytes exhausted (tried to allocate 6324224 bytes) in Unknown on line 0" while reading response header from upstream, client: 10.0.1.10, server: php2shell-lab, request: "POST /index.php HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "10.0.2.168"

Required Output Fields

Source: GitHub | Version: 1