shell脚本-Nginx访问日志分析

合集 - 运维shell脚本(9)

1.shell脚本-监控多台服务器磁盘利用率2023-07-112.shell脚本-批量检查网站是否异常2023-07-123.shell脚本-批量主机执行命令(expect)2023-07-124.shell脚本-lnmp一键部署2023-07-165.shell脚本-MySQL数据库备份2023-07-17

6.shell脚本-Nginx访问日志分析2023-07-17

7.shell脚本-Nginx访问日志自动按天切割2023-07-188.shell脚本-DOS攻击防范(自动屏蔽攻击IP)2023-07-229.shell脚本-入侵检测与告警2023-07-23

收起

shell脚本-Nginx访问日志分析

1.原理

可以通过/usr/local/nginx/logs/access.log 文件-查看nginx的日志

[root@localhost scripts]# tail -f /usr/local/nginx/logs/access.log  
192.168.70.1 - [17/Jul/2023:17:35:21 +0800] "GET / HTTP/1.1" 200 173833 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.82" "-"
192.168.70.1 - [17/Jul/2023:20:53:37 +0800] "GET / HTTP/1.1" 200 173833 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.82" "-"

/usr/local/nginx/conf/nginx.conf 文件-定义了日志输出的格式

可以通过awk命令来取出所需要的数据

[root@localhost scripts]# awk '{print $0}' /usr/local/nginx/logs/access.log
192.168.70.1 - [17/Jul/2023:17:35:21 +0800] "GET / HTTP/1.1" 200 173833 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.82" "-"
192.168.70.1 - [17/Jul/2023:20:53:37 +0800] "GET / HTTP/1.1" 200 173833 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.82" "-"

[root@localhost scripts]# awk '{print $1}' /usr/local/nginx/logs/access.log
192.168.70.1
192.168.70.1

2.shell脚本

Nginx访问日志分析脚本

#!/bin/bash
# 1.访问最多的IP
# 2.根据时间段来访问最多的IP
# 3.访问量超过2次的页面
# 4.访问页面状态码数量

LOG_FILE=$1
echo "统计访问最多的10个IP"
awk '{a[$1]++}END{print "UV:",length(a);for(v in a)print a[v] v}' $LOG_FILE |  sort -k1 -nr | head -10
echo "----------------------------------------"

echo "统计一个时间段访问最多的10个IP"
awk '$3>="[16/Jul/2023:17:35:21" && $3<="[17/Jul/2023:18:00:00"{a[$1]++}END{print "UV:",length(a);for(v in a)print a[v] v}' $LOG_FILE |  sort -k1 -nr | head -10
echo "----------------------------------------"

echo "统计访问量超过2次的页面"
awk '{a[$7]++}END{print "PV:",length(a);for(v in a){if(a[v]>2)print a[v],v}}' $LOG_FILE | sort -k1 -nr
echo "----------------------------------------"

echo "统计访问页面状态码数量"
awk '{a[$7" "$8]++}END{for(v in a)print a[v],v}' $LOG_FILE | sort -k1 -nr

[root@localhost scripts]# bash 13.sh /usr/local/nginx/logs/access.log 
统计访问最多的10个IP
2192.168.70.1
UV: 1
----------------------------------------
统计一个时间段访问最多的10个IP
1192.168.70.1
UV: 1
----------------------------------------
统计访问量超过2次的页面
PV: 1
----------------------------------------
统计访问页面状态码数量
2 HTTP/1.1" 200