Nginx – How to Get List of User-Agents from Nginx Log

Try this:

# map goes *outside* of the "server" block
map $http_user_agent $ignore_ua {
    default                 0;
    "~Pingdom.*"            1;
    "ELB-HealthChecker/1.0" 1;
}

server {
    # Things omitted for brevity

    location / {
        if ($ignore_ua) {
            access_log off;
            return 200;
        }
    }
}    

The if part would probably need to be integrated into your appropriate location block.

Relevant nginx documentation: map, if, access_log

nginx only applies one location block at each level of the config. All the files which are 404ing are .php files which hit the \.php location block, and therefore do not use the / location block which contains your user agent block. To fix this move your user agent block outside the location block to the root level so that it gets applied to all requests.

if ($http_user_agent ~* "morfeus fucking scanner|ZmEu") {
    return 403;
}

location / {
    ...
}

location \.php {
    ...
}

Edit: You can test this with something like curl which lets you set arbitrary headers:

% curl -I localhost/sf645/blah
HTTP/1.1 404 Not Found
% curl -I -H 'User-agent: ZmEu' localhost/sf645/blah
HTTP/1.1 403 Forbidden
% curl -I -H 'User-agent: morfeus fucking scanner' localhost/sf645/blah
HTTP/1.1 403 Forbidden