nginx 每天崩溃，error.log 什么也没显示

Question

我有一个 nginx 服务器设置为反向代理，它似乎每天都在崩溃。服务器以前从未出现过任何问题，但最近（大约一个月前）我开始注意到 nginx 没有运行，我必须登录服务器才能再次启动该过程。

我在日志中找不到任何有用的东西。我很感激在诊断问题方面的任何帮助。

nginx 版本：nginx/1.10.3 (Ubuntu)

操作系统：Ubuntu 16.04.4 LTS（在 LXC 中运行）

# systemctl status nginx
? nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Sat 2018-06-23 21:49:46 UTC; 1min 23s ago
Process: 13485 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=1/FAILURE)
Process: 13402 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Process: 13401 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Main PID: 13403 (code=exited, status=0/SUCCESS)

Jun 23 10:30:17 nginx systemd[1]: Starting A high performance web server and a reverse proxy server...
Jun 23 10:30:17 nginx systemd[1]: Started A high performance web server and a reverse proxy server.

cat /var/log/nginx/error.log

2018/06/23 21:49:46 [notice] 13484#13484: signal process started

access.log文件中没有任何可疑之处。

如果有更多有用的信息，请告诉我

Answer 1

我遇到了同样的问题，并且是相同的错误来源：certbot 正在关闭 nginx 服务器，并且在续订后无法再次启动它。

问题：

您可以通过检查以下日志来检查是否遇到相同的问题。第一个 nginx 日志：

tail -n 100 /var/log/nginx/error.log

结果：

2019/02/05 12:07:37 [notice] 1629#1629: signal process started
2019/02/05 12:07:37 [error] 1629#1629: open() "/run/nginx.pid" failed (2: No such file or directory)
2019/02/05 12:07:38 [emerg] 1655#1655: bind() to 0.0.0.0:80 failed (98: Address already in use)
2019/02/05 12:07:38 [emerg] 1655#1655: bind() to 0.0.0.0:443 failed (98: Address already in use)
2019/02/05 12:07:38 [emerg] 1655#1655: bind() to [::]:443 failed (98: Address already in use)
2019/02/05 12:07:38 [emerg] 1655#1655: bind() to 0.0.0.0:444 failed (98: Address already in use)
2019/02/05 12:07:38 [emerg] 1655#1655: bind() to [::]:444 failed (98: Address already in use)
[...]
2019/02/05 12:07:38 [emerg] 1655#1655: still could not bind()
2019/02/05 12:07:41 [alert] 1631#1631: unlink() "/run/nginx.pid" failed (2: No such file or directory)

我们看到 nginx 尝试重新启动失败。

您也可以检查系统日志：

tail -n 100 /var/log/syslog

并寻找相同的时间戳：

Feb  5 12:07:30 systemd[1]: Starting Certbot...
Feb  5 12:07:31 systemd[1]: Stopping A high performance web server and a reverse proxy server...
Feb  5 12:07:31 systemd[1]: Stopped A high performance web server and a reverse proxy server.
Feb  5 12:07:38 systemd[1]: Starting A high performance web server and a reverse proxy server...

我们看到 certbot 似乎导致了问题。

解决方案：

就我而言，我有一个旧版本的 certbot。您可以使用certbot --version命令检查您的版本。就我而言，我有certbot 0.10.2...

因此，首先，升级您的 certbot 应用程序，并添加 nginx 插件：

sudo apt-get update
sudo apt-get install certbot python-certbot-nginx

检查您的新版本：certbot --version-> certbot 0.28.0。

然后，您将不得不根据新版本修改更新配置文件，并使用 nginx 插件。更新 conf 文件在/etc/letsencrypt/renewal/*目录中。请注意，certbot 文档不鼓励您手动修改它们...

我修改了所有续订配置文件：

# renew_before_expiry = 30 days
version = 0.10.2
archive_dir = /etc/letsencrypt/archive/yourdomain
cert = /etc/letsencrypt/live/yourdomain/cert.pem
privkey = /etc/letsencrypt/live/yourdomain/privkey.pem
chain = /etc/letsencrypt/live/yourdomain/chain.pem
fullchain = /etc/letsencrypt/live/yourdomain/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = standalone
post_hook = service nginx start
account = yourkey
pre_hook = service nginx stop
installer = nginx

到：

# renew_before_expiry = 30 days
version = 0.28.0
archive_dir = /etc/letsencrypt/archive/yourdomain
cert = /etc/letsencrypt/live/yourdomain/cert.pem
privkey = /etc/letsencrypt/live/yourdomain/privkey.pem
chain = /etc/letsencrypt/live/yourdomain/chain.pem
fullchain = /etc/letsencrypt/live/yourdomain/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = yourkey
server = https://acme-v02.api.letsencrypt.org/directory
authenticator = nginx
installer = nginx

（请注意，仅修改了version和authenticationator行，添加了server行，并删除了 pre_hook和post_hook行）。

然后，您可以使用以下命令通过模拟续订来检查您的下一次续订是否会顺利运行：

certbot renew --dry-run

您应该为每个证书获得以下信息，没有红色错误：

new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/yourdomain/fullchain.pem