Nginx 存取日誌分析實戰：格式解析與常用統計腳本

日誌格式解析

預設 combined 格式對應：

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" $custom_field';

實際日誌範例逐欄解析

122.59.14.12 122.59.14.12 - - [24/Apr/2011:10:37:06 +0800] 
"GET /product/sellerscore.do?returnpage=0&supplierid=xxx HTTP/1.1" 
499 0 "https://www.example.com/..." "Mozilla/4.0 ..." custom_value

狀態碼 499 專題

499 Client Closed Request：Nginx 自定義狀態碼，表示客戶端在 Nginx 回應前主動關閉連線。常見於：用戶關閉瀏覽器、網路中斷、前端逾時設定過短、大檔案上傳取消。

實用分析腳本 (一鍵複製執行)

1. 當前 Nginx 進程數

ps aux | grep nginx | grep -v grep | wc -l

2. 指定日期總請求數

grep "24/Apr/2011" /var/log/nginx/access.log | wc -l

3. 指定 IP 當日存取的 URL

grep "24/Apr/2011" /var/log/nginx/access.log | grep "122.59.14.12" | awk '{print $7}'

4. 當日熱門 URL Top 10

grep "24/Apr/2011" /var/log/nginx/access.log | \
awk '{print $7}' | sort | uniq -c | sort -nr | head -10

5. 當日流量熱點時段 (小時級)

grep "24/Apr/2011" /var/log/nginx/access.log | \
awk '{print $4}' | cut -c14-15 | sort | uniq -c | sort -nr | head

6. 狀態碼分布統計

awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

7. 額寬佔用 Top 10 IP

awk '{print $1, $10}' /var/log/nginx/access.log | \
awk '{sum[$1]+=$2} END for (ip in sum) print sum[ip], ip' | sort -nr | head -10

8. 慢請求分析 (需啟用 $request_time)

# log_format 加入 $request_time
awk '$NF > 3 {print $0}' /var/log/nginx/access.log | head -20

生產級建議：引入專業分析工具

• GoAccess：終端機/HTML 即時儀表板，goaccess -f access.log --log-format=COMBINED
• ELK Stack：Elasticsearch + Logstash + Kibana，全文檢索、視覺化、告警
• Graylog：開源日誌管理平台，支援 Grok 解析、Pipeline 處理
• Promtail + Loki + Grafana：輕量級、標籤索引、成本低

日誌輪轉配置 (logrotate)

/var/log/nginx/*.log {
    daily
    missingok
    rotate 30
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
    endscript
}