If some one will have similar issue this is how i solve it (it can't be marked as the right question, because this is a workaround):
inotifywait -m -e modify --format "%w%f" /home/user/log/nginx/example.com.error.log | while read f; do if [[ $(grep "/home/user" $f | wc -c) != 0 ]] ; then sed 's/\/home\/user//g' $f > $f\t ; cat $f\t > $f ; fi done
Where inotifywait (inotify-tools package) is file watcher in monitor mode which is trigger when modification of file are made:
inotifywait -m -e modify --format "%w%f"
then, in a while loop we need to run 2 commands, but first check if the new modification of file contains specific string, to avoid stacking in infinite loop:
if [[ $(grep "/home/user" $f | wc -c) != 0 ]]
If result of command grep "/home/user" $f passed in wc -c which is mean length of string != 0 then modificate file by replaced all /home/user to the 0 length string //, save the output in the temp file and finaly write this output from temp file in the nginx error log file cat $f\t > $f
sed 's/\/home\/user//g' $f > $f\t; cat $f\t > $f;done
nginx
but originates from the PHP FastCGI server and indicates that you are passing uncontrolled requests to PHP.