ok, for testing, I removed the variable from the map, and add one line in a
2-way SSL server config, to create a fresh new variable:

set $test_var "test";

For a request without client cert (400), I see neither "test", nor "-" in
the access log for $test_var. I only see blank, as if the $test_var was set
to "".

Here is the config:

log_format custom '$remote_addr - $remote_user [$time_local] '
'"$request" $status $test_var';
server {
listen *:443 ssl;
server_name _;

ssl_certificate /opt/nginx/ssl/localhost.crt;
ssl_certificate_key /opt/nginx/ssl/localhost.key;
ssl_client_certificate /opt/nginx/ssl/localhost.crt;
ssl_verify_client on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

set $test_var "test";

access_log /tmp/access.log custom;

}

cat /tmp/access.log
127.0.0.1 - - [30/Nov/2020:23:25:12 +0000] "GET / HTTP/1.1" 400





On Mon, Nov 30, 2020 at 2:46 PM Maxim Dounin <mdounin@mdounin.ru> wrote:

> Hello!
>
> On Mon, Nov 30, 2020 at 02:04:35PM -0800, Frank Liu wrote:
>
> > I may have mixed this with special upstream variables, eg:
> > $upstream_http_something. When upstream response header doesn't existing,
> > the variable was logged - in the nginx access logs.
>
> When a variable value is not found, it's logged as "-", that's
> expected behaviour. That's documented in the log_format directive
> description (http://nginx.org/r/log_format):
>
> : If the variable value is not found, a hyphen (“-”) will be
> : logged.
>
> This doesn't apply to found but empty values as in your example
> though.
>
> --
> Maxim Dounin
> http://mdounin.ru/
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx