Nginx日志分析

linux 工具

获取前20的ip访问数量

# 具体截取位置根据日志格式
awk '{print $1}' access-`date "+%Y-%m-%d"`.log | sort | uniq -c | sort -nr | head -n 20

goaccess统计分析

window安装教程

下载goaccess包

https://goaccess.io/

安装cygwin

官网地址

http://www.cygwin.com/

在cygwin中需要安装的包

libGeoIP-devel           | GeoIP2 C library
libncurses-devel         | Terminal display library
libncursesw10            | Terminal display library (wide-character)
gcc-core (C)             | GNU Compiler Collection
make                     | make utility
automake                 | GNU Makefiles
gettext                  | GNU Gettext
automake wrapper scripts | wrapper scripts for automake and aclocal

安装goaccess

将goaccess-1.7.2.tar.gz放入cygwin目录下

打开cygwin

tar -xzvf goaccess-1.7.2.tar.gz
cd goaccess-1.7.2
./configure --enable-utf8 --enable-geoip=legacy
# 如果不成功则执行 ./configure --enable-utf8
make
make install

配置文件格式

nginx.conf

log_format  main  '$remote_addr - $remote_user [$time_iso8601] requesthost:"$http_host"; "$request" requesttime:"$request_time"; '
	'$status $body_bytes_sent "$http_referer" - $request_body'                      
	'"$http_user_agent" "$http_x_forwarded_for"';

## 日志输出

goaccess.conf

time-format %T
date-format %Y-%m-%d
log-format %h - %^ [%dT%t+%^] requesthost:"%v"; "%r" requesttime:"%T"; %s %b "%R" - %^"%u"
##########
# 参数说明
##########
# $remote_addr  >>>  %h
# $remote_user  >>>  %^
# $time_iso8601 >>>  %dT%t+%^
# $http_host    >>>  %v
# $request      >>>  %r
# $request_time >>>  %T
# $status 		>>>  %s
# $body_bytes_sent >>> %b
# $http_referer >>>  %R
# $request_body >>>  %^
# $http_user_agent >>> %u
# $http_x_forwarded_for >>>

启动命令

# 此处采用动态文件路径, 将日志文件输出至cygwin目录下
LANG="zh_CN.UTF-8" goaccess /cygdrive/d/nginx-1.20.2/nginx-1.19.5.1/logs/access-`date "+%Y-%m-%d"`.log -p /cygdrive/d/cygwin64/goaccess-1.7.2/config/goaccess.conf -o D:/cygwin64/report.html