ngxtop命令使用

ngxtop作为分析nginx日志一个很重要的工具，记录一些相关的使用和命令部分

ngxtop --help

一些说明:

Options:

-l <file>, --access-log <file> access log file to parse

指定access log

-f <format>, --log-format <format> log format as specify in log_format directive. [default: combined]

指定 log format

--no-follow ngxtop default behavior is to ignore current lines in log and only watch for new lines as they are written to the access log. Use this flag to tell ngxtop to process the current content of the access log instead

ngxtop默认会对accesslog的新增行进行统计， 通过这个选项可以让ngxtop统计旧log

-t <seconds>, --interval <seconds> report interval when running in follow mode [default: 2.0]

-g <var>, --group-by <var> group by variable [default: request_path]

基于字段分组

-w <var>, --having <expr> having clause [default: 1]

分组之后再筛选

-o <var>, --order-by <var> order of output for default query [default: count]

排序字段

-n <number>, --limit <number> limit the number of records included in report for top command [default: 10]

默认显示前多少条

-a <exp> ..., --a <exp> ... add exp (must be aggregation exp: sum, avg, min, max, etc.) into output 

对输出字段做附加条件 sum/avg/min/max 可选

-v, --verbose more verbose output
-d, --debug print every line and parsed record
-h, --help print this help message.
--version print version information.

Advanced / experimental options:

-c <file>, --config <file> allow ngxtop to parse nginx config file for log format and location 

指定nginx config文件，ngxtop 会自动解析配置文件，分析出access log的位置以及格式

-i <filter-expression>, --filter <filter-expression> filter in, records satisfied given expression are processed

-p <filter-expression>, --pre-filter <filter-expression> in-filter expression to check in pre-parsing phase

常用的一些demo：

$ ngxtop -l nginx.log

top 10 request path with status 404:

$ ngxtop top request_path --filter 'status == 404'

top 10 requests with highest total bytes sent

$ ngxtop --order-by 'avg(bytes_sent) * count'

top 10 remote address

$ ngxtop --group-by remote_addr

find request with 4xx or 5xx status 

$ ngxtop -i 'status >= 400' -l nginx.log