thanks Francis, after testing one by one it was easier to isolate my problem. I have a location definition which turns off the access log, but it doesn't suppose to fire every time, just for specific file extensions, here is the entire server block:

52 server {
53 listen 80 default_server;
54 server_name www.DOMAIN_A.com *.DOMAIN_A.com;
55 error_log /var/log/nginx/DOMAIN_A.error.log debug;
56 access_log /var/log/nginx/DOMAIN_A.access.log;
57
58 root /srv/www/DOMAIN_A.com/public_html;
59
60 error_page 404 /404.html;
61
62 location ~* \.(jpg|jpeg|gif|css|png|js|ico|html)$ {
63 # access_log off;
64 expires max;
65 }
66
67 location ~ /\.ht {
68 deny all;
69 }
70 }

The desired intention of line 62 is to turn off access log only for resources with given extensions, however I found it is firing everytime.

for instance, this URL: http://DOMAIN_A/aaaa.txt is not supposed to fire that rule, but it does. As soon as I comment line 63 (and restart nginx) the access log gets updated. I have repeated this several times (adding/removing comment in line 63) with same results.

I don't see nothing wrong with that regular expression, so I'm not sure what is going on.