ngxtop实时解析nginx访问日志

#
 wget https://github.com/lebinh/ngxtop/archive/master.zip -O ngxtop-master.zip

#
 unzip ngxtop-master.zip

#
 cd ngxtop-master

#
 python setup.py install

...省略....

Finished
 processing dependencies

for

ngxtop==0.0.1

pip

install

ngxtop

#
 ngxtop --help

ngxtop
 - ad-hoc query

for

nginx
 access log.

Usage:

ngxtop
 [options]

ngxtop
 [options] (print|

top

|avg|

sum

)
 <var> ...

ngxtop
 info

ngxtop
 [options] query <query> ...

Options:

-l
 <

file

>,
 --access-log <

file

> 
 需要分析的访问日志

-f
 <

format

>,
 --log-

format

<

format

> 
 log_format指令指定的日志格式 [默认: combined]

--no-follow 
 ngxtop default behavioris to ignore current lines

in

log

and
 only

watch

for

new
 lines as they are written to the access log.

Use
 this flag to tell ngxtop to process the current content of the access log instead.

-t
 <seconds>, --interval <seconds>  report interval when running

in

follow
 mode [default: 2.0]

-g
 <var>, --group-by <var>  根据变量分组 [默认: request_path]

-w
 <var>, --having <

expr

> 
 having clause [default: 1]

-o
 <var>, --order-by <var>  排序 [默认: count]

-n
 <number>, --limit <number>  显示的条数 [default: 10]

-a
 <exp> ..., --a <exp> ...  add exp (must be aggregation exp:

sum

,
 avg, min, max, etc.) into output

-

v

,
 --verbose  更多的输出

-d,
 --debug  print every line and parsed record

-h,
 --help  当前帮助信息.

--version 
 输出版本信息.

高级选项:

-c
 <

file

>,
 --config<

file

> 
 运行ngxtop解析nginx配置文件

-i
 <filter-expression>, --filter <filter-expression>  filter

in

,
 records satisfied given expression are processed.

-p
 <filter-expression>, --pre-filter <filter-expression>

in

-filter
 expression to check

in

pre-parsing
 phase.

范例:

All
 examples

read

nginx
 config

file

for

access
 log location and

format

.

If
 you want to specify the access log

file

and
 / orlog

format

,
 use the -f and -a options.

"top"

like
 view of nginx requests

$
 ngxtop

404前十的请求

$
 ngxtop 

top

request_path
 --filter

'status
 == 404'

总流量前十的请求

$
 ngxtop --order-by 

'avg(bytes_sent)
 * count'

访问量前十的ip地址

$
 ngxtop --group-by remote_addr

输出400以上状态吗的请求以及请求来源

$
 ngxtop -i 

'status
 >= 400'

print
 request status http_referer

Average
 body bytes sent of 200 responses of requested path begin with

'foo'

:

$
 ngxtop avg bytes_sent --filter 

'status
 == 200 and request_path.startswith("foo")'

使用common日志格式分析远程服务器Apache访问日志

$

ssh

remote

tail

-f
 /var/log/apache2/access.log | ngxtop -f common

#
 ngxtop -c /usr/local/nginx-1.5.2/conf/nginx.conf

#
 ngxtop -c /usr/local/nginx-1.5.2/conf/nginx.conf top remote_addr

#
 ngxtop

Error:
 Access log

file

or

format

was
 not

set

and
 nginx

config

file

cannot
 be detected. Perhaps nginx is not

in

your
 PATH?

#
 ln -s /usr/local/nginx-1.5.2/sbin/nginx /sbin/

#
 vim /etc/profile

export

PATH=$PATH:/usr/

local

/nginx-1.5.2/sbin

#
 source /etc/profile

#
 ngxtop -c /usr/local/nginx-1.5.2/conf/nginx.conf