How to monitor Nginx logs in Real Time in Linux with ngxtop

How to Install and Use Ngxtop in Linux

To install ngxtop, first you need to install PIP in Linux, depending on your OS you might need the EPEL repository installed.
Here is a quide to install EPEL - https://community.webcore.cloud/tutorials/how_to_install_pip_on_centos_7/.

Once you have pip installed on your system, you can install ngxtop using following command.

pip install ngxtop

Monitor Nginx Server Requests

Now that you have installed ngxtop, the easiest way to run it is without any arguments. This will parse the /var/log/nginx/access.log and runs in follow mode (watch for new lines as they are written to the access log) by default.

ngxtop

Sample Output

running for 411 seconds, 64332 records processed: 156.60 req/sec

Summary:
| count | avg_bytes_sent | 2xx | 3xx | 4xx | 5xx |
|---------+------------------+-------+-------+-------+-------|
| 64332 | 2775.251 | 61262 | 2994 | 71 | 5 |

Detailed:
| request_path | count | avg_bytes_sent | 2xx | 3xx | 4xx | 5xx |
|------------------------------------------+---------+------------------+-------+-------+-------+-------|
| /abc/xyz/xxxx | 20946 | 434.693 | 20935 | 0 | 11 | 0 |
| /xxxxx.json | 5633 | 1483.723 | 5633 | 0 | 0 | 0 |
| /xxxxx/xxx/xxxxxxxxxxxxx | 3629 | 6835.499 | 3626 | 0 | 3 | 0 |
| /xxxxx/xxx/xxxxxxxx | 3627 | 15971.885 | 3623 | 0 | 4 | 0 |
| /xxxxx/xxx/xxxxxxx | 3624 | 7830.236 | 3621 | 0 | 3 | 0 |
| /static/js/minified/utils.min.js | 3031 | 1781.155 | 2104 | 927 | 0 | 0 |
| /static/js/minified/xxxxxxx.min.v1.js | 2889 | 2210.235 | 2068 | 821 | 0 | 0 |
| /static/tracking/js/xxxxxxxx.js | 2594 | 1325.681 | 1927 | 667 | 0 | 0 |
| /xxxxx/xxx.html | 2521 | 573.597 | 2520 | 0 | 1 | 0 |
| /xxxxx/xxxx.json | 1840 | 800.542 | 1839 | 0 | 1 | 0 |

To quit, press [Ctrl + C]. Parse Different Access Log

You can parse a different access log, for instance for a particular website or web app using the -l flag as shown.

sudo ngxtop -l /var/log/nginx/site1/access.log

List Top Source IPs of Clients

The following command will list all top source IP’s of clients accessing the site.

sudo ngxtop remote_addr -l  /var/log/nginx/site1/access.log

Sample Output

running for 20 seconds, 3215 records processed: 159.62 req/sec

top remote_addr
| remote_addr | count |
|-----------------+---------|
| 118.173.177.161 | 20 |
| 110.78.145.3 | 16 |
| 171.7.153.7 | 16 |
| 180.183.67.155 | 16 |
| 183.89.65.9 | 16 |
| 202.28.182.5 | 16 |
| 1.47.170.12 | 15 |
| 119.46.184.2 | 15 |
| 125.26.135.219 | 15 |
| 125.26.213.203 | 15 |

Use Particular Log Format

To use a log format as specified in log_format directive, employ the -f option as shown.

sudo ngxtop -f main -l /var/log/nginx/site1/access.log

Parse Apache Log From Remote Server

To parse Apache log file from a remote server with common format, use a command similar to the following (specify your username and remote server IP).

ssh user@remote_server tail -f /var/log/apache2/access.log | ngxtop -f common

Sample Output

running for 20 seconds, 1068 records processed: 53.01 req/sec

Summary: | count | avg_bytes_sent | 2xx | 3xx | 4xx | 5xx |
|---------+------------------+-------+-------+-------+-------|
| 1068 | 28026.763 | 1029 | 20 | 19 | 0 |

Detailed: | request_path | count | avg_bytes_sent | 2xx | 3xx | 4xx | 5xx |
|------------------------------------------+---------+------------------+-------+-------+-------+-------|
| /xxxxxxxxxx | 199 | 55150.402 | 199 | 0 | 0 | 0 |
| /xxxxxxxx/xxxxx | 167 | 47591.826 | 167 | 0 | 0 | 0 |
| /xxxxxxxxxxxxx/xxxxxx | 25 | 7432.200 | 25 | 0 | 0 | 0 |
| /xxxx/xxxxx/x/xxxxxxxxxxxxx/xxxxxxx | 22 | 698.727 | 22 | 0 | 0 | 0 |
| /xxxx/xxxxx/x/xxxxxxxxxxxxx/xxxxxx | 19 | 7431.632 | 19 | 0 | 0 | 0 |
| /xxxxx/xxxxx/ | 18 | 7840.889 | 18 | 0 | 0 | 0 |
| /xxxxxxxx/xxxxxxxxxxxxxxxxx | 15 | 7356.000 | 15 | 0 | 0 | 0 |
| /xxxxxxxxxxx/xxxxxxxx | 15 | 9978.800 | 15 | 0 | 0 | 0 |
| /xxxxx/ | 14 | 0.000 | 0 | 14 | 0 | 0 |
| /xxxxxxxxxx/xxxxxxxx/xxxxx | 13 | 20530.154 | 13 | 0 | 0 | 0 |

For more usage options, view the ngxtop help message using the following command.

ngxtop -h