Nginx日志文件的位置与基础查看指南

/usr/local/var/log/nginx/access.log
/usr/local/var/log/nginx/error.log

docker logs your-nginx-container

docker run -d \
  -v /host/logs/nginx:/var/log/nginx \
  --name my-nginx \
  nginx

/etc/nginx/nginx.conf

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log warn;
}

# 查看Nginx主配置文件路径
nginx -t

# 输出类似：
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

# 然后查看配置
cat /etc/nginx/nginx.conf | grep -E "access_log|error_log"

192.168.1.100 - - [25/Apr/2024:10:30:22 +0800] "GET /index.html HTTP/1.1" 200 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-"

log_format detailed '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    '$request_time $upstream_response_time';

access_log /var/log/nginx/access.log detailed;

2024/04/25 10:31:15 [error] 1234#1234: *5678 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.1.100, server: example.com, request: "GET /api/user HTTP/1.1", upstream: "http://127.0.0.1:8080/api/user", host: "example.com"

error_log /var/log/nginx/error.log debug;

cat /var/log/nginx/access.log

less /var/log/nginx/access.log

tail -f /var/log/nginx/access.log

tail -n 50 /var/log/nginx/error.log

# 查看所有404错误
grep " 404 " /var/log/nginx/access.log

# 查看所有502错误
grep " 502 " /var/log/nginx/error.log

# 查看某个IP的所有请求
grep "192.168.1.100" /var/log/nginx/access.log

# 查看请求时间超过2秒的请求（需要配合awk）
awk '$10 > 2 {print}' /var/log/nginx/access.log

# 提取所有状态码和访问次数
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

# 输出示例：
#   1234 200
#    234 404
#     89 500

# 提取前10个最频繁访问的URL
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

# 提取访问时间最长的前5个请求（假设你用了detailed格式，第10列是$request_time）
awk '{print $10, $7}' /var/log/nginx/access.log | sort -nr | head -5

# 查看Nginx服务日志（包含access和error）
journalctl -u nginx

# 实时追踪
journalctl -u nginx -f

# 只看最近1小时
journalctl -u nginx --since "1 hour ago"

192.168.1.100 - - [25/Apr/2024:10:30:22 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.045 0.042
192.168.1.101 - - [25/Apr/2024:10:30:23 +0800] "GET /api/v1/product HTTP/1.1" 404 567 "-" "curl/7.68.0" 0.002 0.001
192.168.1.100 - - [25/Apr/2024:10:30:24 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.089 0.085
192.168.1.102 - - [25/Apr/2024:10:30:25 +0800] "GET /admin HTTP/1.1" 404 567 "-" "Mozilla/5.0" 0.001 0.000
192.168.1.103 - - [25/Apr/2024:10:30:26 +0800] "GET /api/v1/order HTTP/1.1" 500 1000 "-" "PostmanRuntime/7.30.0" 2.100 2.050
192.168.1.100 - - [25/Apr/2024:10:30:27 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.033 0.030
192.168.1.104 - - [25/Apr/2024:10:30:28 +0800] "GET /favicon.ico HTTP/1.1" 404 567 "-" "Mozilla/5.0" 0.001 0.000
192.168.1.105 - - [25/Apr/2024:10:30:29 +0800] "GET /api/v1/product HTTP/1.1" 404 567 "-" "curl/7.68.0" 0.002 0.001
192.168.1.106 - - [25/Apr/2024:10:30:30 +0800] "POST /login HTTP/1.1" 401 120 "-" "BurpSuite" 0.005 0.004
192.168.1.107 - - [25/Apr/2024:10:30:31 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.022 0.020

import java.io.*;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import java.util.stream.Collectors;
import java.util.stream.Stream;
public class NginxLogAnalyzer {
    public static void main(String[] args) {
        String logFilePath = "/var/log/nginx/access.log"; // 替换为你的日志路径
        System.out.println("🚀 Nginx日志分析工具启动中... 🚀\n");
        try {
            List<LogEntry> logs = parseLogEntries(logFilePath);
            if (logs.isEmpty()) {
                System.out.println("⚠️ 未找到有效日志条目，请检查文件路径或格式。\n");
                return;
            }
            System.out.println("📊 分析结果如下：\n");
            // 1. 统计HTTP状态码分布
            analyzeStatusCodes(logs);
            // 2. 找出最慢的10个请求
            analyzeSlowestRequests(logs);
            // 3. 统计Top 10 IP访问频率
            analyzeTopIPs(logs);
            // 4. 统计404错误最多的URL
            analyzeTop404Urls(logs);
            // 5. 检测异常行为：同一IP在1秒内请求>5次
            detectSuspiciousActivity(logs);
        } catch (IOException e) {
            System.err.println("❌ 读取日志文件失败: " + e.getMessage());
        }
    }
    // 解析每一行日志
    static List<LogEntry> parseLogEntries(String filePath) throws IOException {
        List<LogEntry> entries = new ArrayList<>();
        try (Stream<String> lines = Files.lines(Paths.get(filePath))) {
            lines.filter(line -> !line.trim().isEmpty())
                 .forEach(line -> {
                     try {
                         LogEntry entry = parseLogLine(line);
                         if (entry != null) entries.add(entry);
                     } catch (Exception e) {
                         // 忽略格式错误的行
                         System.err.println("⚠️ 解析失败行: " + line);
                     }
                 });
        }
        return entries;
    }
    // 解析单行日志（按空格分割，注意URL可能含空格，所以不能简单split）
    static LogEntry parseLogLine(String line) {
        // 我们假设格式是：IP - - [时间] "请求" 状态 字节数 "Referer" "UA" 请求耗时 上游耗时
        // 用正则更安全，但为简化，我们按空格拆分，然后合并请求字段
        String[] parts = line.split(" ", 10); // 最多切10份
        if (parts.length < 10) return null;
        String clientIp = parts[0];
        String requestTimeStr = parts[3].substring(1); // 去掉 [
        String request = parts[5] + " " + parts[6] + " " + parts[7]; // GET /api/user HTTP/1.1
        int status = Integer.parseInt(parts[8]);
        long bodyBytes = Long.parseLong(parts[9]);
        double requestTime = Double.parseDouble(parts[10]);
        double upstreamTime = parts.length > 11 ? Double.parseDouble(parts[11]) : 0.0;
        // 提取时间
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("dd/MMM/yyyy:HH:mm:ss Z");
        LocalDateTime time = LocalDateTime.parse(requestTimeStr, formatter);
        return new LogEntry(
            clientIp,
            time,
            request,
            status,
            bodyBytes,
            requestTime,
            upstreamTime
        );
    }
    // 统计状态码分布
    static void analyzeStatusCodes(List<LogEntry> logs) {
        Map<Integer, Long> statusCount = logs.stream()
            .collect(Collectors.groupingBy(LogEntry::getStatus, Collectors.counting()));
        System.out.println("🔢 HTTP状态码统计：");
        statusCount.entrySet().stream()
            .sorted(Map.Entry.<Integer, Long>comparingByValue().reversed())
            .forEach(e -> System.out.printf("    %d: %d 次%n", e.getKey(), e.getValue()));
        System.out.println();
    }
    // 找出最慢的10个请求
    static void analyzeSlowestRequests(List<LogEntry> logs) {
        System.out.println("🐢 最慢的10个请求（按$request_time排序）：");
        logs.stream()
            .sorted(Comparator.comparingDouble(LogEntry::getRequestTime).reversed())
            .limit(10)
            .forEach(entry -> System.out.printf(
                "    %.3fs | %d %s | IP: %s%n",
                entry.getRequestTime(),
                entry.getStatus(),
                entry.getRequest(),
                entry.getClientIp()
            ));
        System.out.println();
    }
    // 统计Top 10 IP访问频率
    static void analyzeTopIPs(List<LogEntry> logs) {
        System.out.println("📍 Top 10 访问IP：");
        logs.stream()
            .collect(Collectors.groupingBy(LogEntry::getClientIp, Collectors.counting()))
            .entrySet().stream()
            .sorted(Map.Entry.<String, Long>comparingByValue().reversed())
            .limit(10)
            .forEach(e -> System.out.printf("    %s: %d 次%n", e.getKey(), e.getValue()));
        System.out.println();
    }
    // 统计404错误最多的URL
    static void analyzeTop404Urls(List<LogEntry> logs) {
        System.out.println("🔍 404错误最多的URL（前5）：");
        logs.stream()
            .filter(entry -> entry.getStatus() == 404)
            .collect(Collectors.groupingBy(LogEntry::getRequest, Collectors.counting()))
            .entrySet().stream()
            .sorted(Map.Entry.<String, Long>comparingByValue().reversed())
            .limit(5)
            .forEach(e -> System.out.printf("    %s: %d 次%n", e.getKey(), e.getValue()));
        System.out.println();
    }
    // 检测可疑行为：同一IP在1秒内请求>5次
    static void detectSuspiciousActivity(List<LogEntry> logs) {
        System.out.println("🚨 可疑行为检测（同一IP在1秒内>5次请求）：");
        Map<String, List<LogEntry>> ipGroups = logs.stream()
            .collect(Collectors.groupingBy(LogEntry::getClientIp));
        ipGroups.entrySet().stream()
            .filter(entry -> entry.getValue().size() > 5)
            .forEach(entry -> {
                String ip = entry.getKey();
                List<LogEntry> requests = entry.getValue();
                requests.sort(Comparator.comparing(LogEntry::getTime));
                // 检查是否存在连续5个请求在1秒内
                for (int i = 0; i <= requests.size() - 5; i++) {
                    LocalDateTime start = requests.get(i).getTime();
                    LocalDateTime end = requests.get(i + 4).getTime();
                    long diffSeconds = java.time.Duration.between(start, end).getSeconds();
                    if (diffSeconds <= 1) {
                        System.out.printf("    ⚠️ IP: %s 在 %s 到 %s 间发起 %d 次请求（%d秒内）%n",
                            ip, start, end, 5, diffSeconds);
                        break;
                    }
                }
            });
        System.out.println();
    }
    // 日志条目模型
    static class LogEntry {
        private final String clientIp;
        private final LocalDateTime time;
        private final String request;
        private final int status;
        private final long bodyBytes;
        private final double requestTime;
        private final double upstreamTime;
        public LogEntry(String clientIp, LocalDateTime time, String request, int status,
                        long bodyBytes, double requestTime, double upstreamTime) {
            this.clientIp = clientIp;
            this.time = time;
            this.request = request;
            this.status = status;
            this.bodyBytes = bodyBytes;
            this.requestTime = requestTime;
            this.upstreamTime = upstreamTime;
        }
        // Getters
        public String getClientIp() { return clientIp; }
        public LocalDateTime getTime() { return time; }
        public String getRequest() { return request; }
        public int getStatus() { return status; }
        public long getBodyBytes() { return bodyBytes; }
        public double getRequestTime() { return requestTime; }
        public double getUpstreamTime() { return upstreamTime; }
    }
}

🚀 Nginx日志分析工具启动中... 🚀

📊 分析结果如下：

🔢 HTTP状态码统计：
    200: 5 次
    404: 4 次
    401: 1 次
    500: 1 次

🐢 最慢的10个请求（按$request_time排序）：
    2.100s | 500 GET /api/v1/order HTTP/1.1 | IP: 192.168.1.103
    0.089s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.100
    0.045s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.100
    0.033s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.100
    0.022s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.107
    0.005s | 401 POST /login HTTP/1.1 | IP: 192.168.1.106
    0.002s | 404 GET /api/v1/product HTTP/1.1 | IP: 192.168.1.101
    0.002s | 404 GET /api/v1/product HTTP/1.1 | IP: 192.168.1.105
    0.001s | 404 GET /admin HTTP/1.1 | IP: 192.168.1.102
    0.001s | 404 GET /favicon.ico HTTP/1.1 | IP: 192.168.1.104

📍 Top 10 访问IP：
    192.168.1.100: 4 次
    192.168.1.101: 1 次
    192.168.1.102: 1 次
    192.168.1.103: 1 次
    192.168.1.104: 1 次
    192.168.1.105: 1 次
    192.168.1.106: 1 次
    192.168.1.107: 1 次

🔍 404错误最多的URL（前5）：
    GET /api/v1/product HTTP/1.1: 2 次
    GET /admin HTTP/1.1: 1 次
    GET /favicon.ico HTTP/1.1: 1 次

🚨 可疑行为检测（同一IP在1秒内>5次请求）：
    （无输出，说明没有异常）

tail -f /var/log/nginx/error.log

connect() failed (111: Connection refused) while connecting to upstream

# 检查Java应用是否启动
ps aux | grep java

# 检查端口是否监听
netstat -tlnp | grep 8080

# 或者用 ss（推荐）
ss -tlnp | grep 8080

# 如果没监听 → 启动Java应用
nohup java -jar your-app.jar > app.log 2>&1 &

grep " 404 " /var/log/nginx/access.log | awk '{print $7}' | sort | uniq -c | sort -nr | head -20

  1200 /wp-admin
   800 /phpmyadmin
   500 /api/v1/user/123456

# 启用缓冲
proxy_buffering on;
proxy_buffer_size 128k;
proxy_buffers 4 256k;

# 增加超时
proxy_read_timeout 60s;
proxy_connect_timeout 60s;

# 缓存静态资源
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}

sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 3
bantime = 3600

sudo systemctl restart fail2ban

limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;

server {
    location /api/login {
        limit_req zone=login_limit burst=5 nodelay;
        proxy_pass http://backend;
    }
}

# 查看日志大小
ls -lh /var/log/nginx/

# 清空日志（保留文件，清空内容）
> /var/log/nginx/access.log

# 或者压缩归档
gzip /var/log/nginx/access.log
mv /var/log/nginx/access.log.gz /var/log/nginx/access.log.20240425.gz

/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
    endscript
}

#!/bin/bash
# /usr/local/bin/nginx-daily-report.sh

LOG_FILE="/var/log/nginx/access.log"
REPORT_FILE="/tmp/nginx-report-$(date +%Y%m%d).txt"

echo "📊 Nginx日志日报 - $(date)" > $REPORT_FILE
echo "=========================================" >> $REPORT_FILE

# 统计总请求数
TOTAL=$(wc -l < $LOG_FILE)
echo "✅ 总请求数: $TOTAL" >> $REPORT_FILE

# 统计404
ERROR_404=$(grep " 404 " $LOG_FILE | wc -l)
echo "❌ 404错误: $ERROR_404" >> $REPORT_FILE

# 最慢的3个请求
echo -e "\n🐢 最慢的3个请求：" >> $REPORT_FILE
awk '{print $10, $7}' $LOG_FILE | sort -nr | head -3 >> $REPORT_FILE

# 发送邮件（需配置sendmail或postfix）
mail -s "Nginx日志日报 $(date +%Y-%m-%d)" your-email@example.com < $REPORT_FILE

# 清理
rm $REPORT_FILE

crontab -e

0 8 * * * /usr/local/bin/nginx-daily-report.sh

# Ubuntu安装GoAccess
sudo apt install goaccess

# 实时分析Nginx日志
goaccess /var/log/nginx/access.log --log-format=COMBINED -a

tail -f /var/log/nginx/access.log