/usr/local/var/log/nginx/access.log
/usr/local/var/log/nginx/error.log

docker logs your-nginx-container

docker run -d \
  -v /host/logs/nginx:/var/log/nginx \
  --name my-nginx \
  nginx

/etc/nginx/nginx.conf

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log warn;
}

# 查看Nginx主配置文件路徑
nginx -t

# 輸出類似：
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

# 然后查看配置
cat /etc/nginx/nginx.conf | grep -E "access_log|error_log"

192.168.1.100 - - [25/Apr/2024:10:30:22 +0800] "GET /index.html HTTP/1.1" 200 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-"

log_format detailed '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    '$request_time $upstream_response_time';

access_log /var/log/nginx/access.log detailed;

2024/04/25 10:31:15 [error] 1234#1234: *5678 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.1.100, server: example.com, request: "GET /api/user HTTP/1.1", upstream: "http://127.0.0.1:8080/api/user", host: "example.com"

error_log /var/log/nginx/error.log debug;

cat /var/log/nginx/access.log

less /var/log/nginx/access.log

tail -n 50 /var/log/nginx/error.log

# 提取所有狀態(tài)碼和訪問(wèn)次數(shù)
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

# 輸出示例：
#   1234 200
#    234 404
#     89 500

# 提取前10個(gè)最頻繁訪問(wèn)的URL
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

# 提取訪問(wèn)時(shí)間最長(zhǎng)的前5個(gè)請(qǐng)求（假設(shè)你用了detailed格式，第10列是$request_time）
awk '{print $10, $7}' /var/log/nginx/access.log | sort -nr | head -5

# 查看Nginx服務(wù)日志（包含access和error）
journalctl -u nginx

# 實(shí)時(shí)追蹤
journalctl -u nginx -f

# 只看最近1小時(shí)
journalctl -u nginx --since "1 hour ago"

192.168.1.100 - - [25/Apr/2024:10:30:22 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.045 0.042
192.168.1.101 - - [25/Apr/2024:10:30:23 +0800] "GET /api/v1/product HTTP/1.1" 404 567 "-" "curl/7.68.0" 0.002 0.001
192.168.1.100 - - [25/Apr/2024:10:30:24 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.089 0.085
192.168.1.102 - - [25/Apr/2024:10:30:25 +0800] "GET /admin HTTP/1.1" 404 567 "-" "Mozilla/5.0" 0.001 0.000
192.168.1.103 - - [25/Apr/2024:10:30:26 +0800] "GET /api/v1/order HTTP/1.1" 500 1000 "-" "PostmanRuntime/7.30.0" 2.100 2.050
192.168.1.100 - - [25/Apr/2024:10:30:27 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.033 0.030
192.168.1.104 - - [25/Apr/2024:10:30:28 +0800] "GET /favicon.ico HTTP/1.1" 404 567 "-" "Mozilla/5.0" 0.001 0.000
192.168.1.105 - - [25/Apr/2024:10:30:29 +0800] "GET /api/v1/product HTTP/1.1" 404 567 "-" "curl/7.68.0" 0.002 0.001
192.168.1.106 - - [25/Apr/2024:10:30:30 +0800] "POST /login HTTP/1.1" 401 120 "-" "BurpSuite" 0.005 0.004
192.168.1.107 - - [25/Apr/2024:10:30:31 +0800] "GET /api/v1/user HTTP/1.1" 200 1234 "-" "Mozilla/5.0" 0.022 0.020

import java.io.*;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import java.util.stream.Collectors;
import java.util.stream.Stream;
public class NginxLogAnalyzer {
    public static void main(String[] args) {
        String logFilePath = "/var/log/nginx/access.log"; // 替換為你的日志路徑
        System.out.println("?? Nginx日志分析工具啟動(dòng)中... ??\n");
        try {
            List<LogEntry> logs = parseLogEntries(logFilePath);
            if (logs.isEmpty()) {
                System.out.println("?? 未找到有效日志條目，請(qǐng)檢查文件路徑或格式。\n");
                return;
            }
            System.out.println("?? 分析結(jié)果如下：\n");
            // 1. 統(tǒng)計(jì)HTTP狀態(tài)碼分布
            analyzeStatusCodes(logs);
            // 2. 找出最慢的10個(gè)請(qǐng)求
            analyzeSlowestRequests(logs);
            // 3. 統(tǒng)計(jì)Top 10 IP訪問(wèn)頻率
            analyzeTopIPs(logs);
            // 4. 統(tǒng)計(jì)404錯(cuò)誤最多的URL
            analyzeTop404Urls(logs);
            // 5. 檢測(cè)異常行為：同一IP在1秒內(nèi)請(qǐng)求>5次
            detectSuspiciousActivity(logs);
        } catch (IOException e) {
            System.err.println("? 讀取日志文件失敗: " + e.getMessage());
        }
    }
    // 解析每一行日志
    static List<LogEntry> parseLogEntries(String filePath) throws IOException {
        List<LogEntry> entries = new ArrayList<>();
        try (Stream<String> lines = Files.lines(Paths.get(filePath))) {
            lines.filter(line -> !line.trim().isEmpty())
                 .forEach(line -> {
                     try {
                         LogEntry entry = parseLogLine(line);
                         if (entry != null) entries.add(entry);
                     } catch (Exception e) {
                         // 忽略格式錯(cuò)誤的行
                         System.err.println("?? 解析失敗行: " + line);
                     }
                 });
        }
        return entries;
    }
    // 解析單行日志（按空格分割，注意URL可能含空格，所以不能簡(jiǎn)單split）
    static LogEntry parseLogLine(String line) {
        // 我們假設(shè)格式是：IP - - [時(shí)間] "請(qǐng)求" 狀態(tài) 字節(jié)數(shù) "Referer" "UA" 請(qǐng)求耗時(shí) 上游耗時(shí)
        // 用正則更安全，但為簡(jiǎn)化，我們按空格拆分，然后合并請(qǐng)求字段
        String[] parts = line.split(" ", 10); // 最多切10份
        if (parts.length < 10) return null;
        String clientIp = parts[0];
        String requestTimeStr = parts[3].substring(1); // 去掉 [
        String request = parts[5] + " " + parts[6] + " " + parts[7]; // GET /api/user HTTP/1.1
        int status = Integer.parseInt(parts[8]);
        long bodyBytes = Long.parseLong(parts[9]);
        double requestTime = Double.parseDouble(parts[10]);
        double upstreamTime = parts.length > 11 ? Double.parseDouble(parts[11]) : 0.0;
        // 提取時(shí)間
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("dd/MMM/yyyy:HH:mm:ss Z");
        LocalDateTime time = LocalDateTime.parse(requestTimeStr, formatter);
        return new LogEntry(
            clientIp,
            time,
            request,
            status,
            bodyBytes,
            requestTime,
            upstreamTime
        );
    }
    // 統(tǒng)計(jì)狀態(tài)碼分布
    static void analyzeStatusCodes(List<LogEntry> logs) {
        Map<Integer, Long> statusCount = logs.stream()
            .collect(Collectors.groupingBy(LogEntry::getStatus, Collectors.counting()));
        System.out.println("?? HTTP狀態(tài)碼統(tǒng)計(jì)：");
        statusCount.entrySet().stream()
            .sorted(Map.Entry.<Integer, Long>comparingByValue().reversed())
            .forEach(e -> System.out.printf("    %d: %d 次%n", e.getKey(), e.getValue()));
        System.out.println();
    }
    // 找出最慢的10個(gè)請(qǐng)求
    static void analyzeSlowestRequests(List<LogEntry> logs) {
        System.out.println("?? 最慢的10個(gè)請(qǐng)求（按$request_time排序）：");
        logs.stream()
            .sorted(Comparator.comparingDouble(LogEntry::getRequestTime).reversed())
            .limit(10)
            .forEach(entry -> System.out.printf(
                "    %.3fs | %d %s | IP: %s%n",
                entry.getRequestTime(),
                entry.getStatus(),
                entry.getRequest(),
                entry.getClientIp()
            ));
        System.out.println();
    }
    // 統(tǒng)計(jì)Top 10 IP訪問(wèn)頻率
    static void analyzeTopIPs(List<LogEntry> logs) {
        System.out.println("?? Top 10 訪問(wèn)IP：");
        logs.stream()
            .collect(Collectors.groupingBy(LogEntry::getClientIp, Collectors.counting()))
            .entrySet().stream()
            .sorted(Map.Entry.<String, Long>comparingByValue().reversed())
            .limit(10)
            .forEach(e -> System.out.printf("    %s: %d 次%n", e.getKey(), e.getValue()));
        System.out.println();
    }
    // 統(tǒng)計(jì)404錯(cuò)誤最多的URL
    static void analyzeTop404Urls(List<LogEntry> logs) {
        System.out.println("?? 404錯(cuò)誤最多的URL（前5）：");
        logs.stream()
            .filter(entry -> entry.getStatus() == 404)
            .collect(Collectors.groupingBy(LogEntry::getRequest, Collectors.counting()))
            .entrySet().stream()
            .sorted(Map.Entry.<String, Long>comparingByValue().reversed())
            .limit(5)
            .forEach(e -> System.out.printf("    %s: %d 次%n", e.getKey(), e.getValue()));
        System.out.println();
    }
    // 檢測(cè)可疑行為：同一IP在1秒內(nèi)請(qǐng)求>5次
    static void detectSuspiciousActivity(List<LogEntry> logs) {
        System.out.println("?? 可疑行為檢測(cè)（同一IP在1秒內(nèi)>5次請(qǐng)求）：");
        Map<String, List<LogEntry>> ipGroups = logs.stream()
            .collect(Collectors.groupingBy(LogEntry::getClientIp));
        ipGroups.entrySet().stream()
            .filter(entry -> entry.getValue().size() > 5)
            .forEach(entry -> {
                String ip = entry.getKey();
                List<LogEntry> requests = entry.getValue();
                requests.sort(Comparator.comparing(LogEntry::getTime));
                // 檢查是否存在連續(xù)5個(gè)請(qǐng)求在1秒內(nèi)
                for (int i = 0; i <= requests.size() - 5; i++) {
                    LocalDateTime start = requests.get(i).getTime();
                    LocalDateTime end = requests.get(i + 4).getTime();
                    long diffSeconds = java.time.Duration.between(start, end).getSeconds();
                    if (diffSeconds <= 1) {
                        System.out.printf("    ?? IP: %s 在 %s 到 %s 間發(fā)起 %d 次請(qǐng)求（%d秒內(nèi)）%n",
                            ip, start, end, 5, diffSeconds);
                        break;
                    }
                }
            });
        System.out.println();
    }
    // 日志條目模型
    static class LogEntry {
        private final String clientIp;
        private final LocalDateTime time;
        private final String request;
        private final int status;
        private final long bodyBytes;
        private final double requestTime;
        private final double upstreamTime;
        public LogEntry(String clientIp, LocalDateTime time, String request, int status,
                        long bodyBytes, double requestTime, double upstreamTime) {
            this.clientIp = clientIp;
            this.time = time;
            this.request = request;
            this.status = status;
            this.bodyBytes = bodyBytes;
            this.requestTime = requestTime;
            this.upstreamTime = upstreamTime;
        }
        // Getters
        public String getClientIp() { return clientIp; }
        public LocalDateTime getTime() { return time; }
        public String getRequest() { return request; }
        public int getStatus() { return status; }
        public long getBodyBytes() { return bodyBytes; }
        public double getRequestTime() { return requestTime; }
        public double getUpstreamTime() { return upstreamTime; }
    }
}

?? Nginx日志分析工具啟動(dòng)中... ??

?? 分析結(jié)果如下：

?? HTTP狀態(tài)碼統(tǒng)計(jì)：
    200: 5 次
    404: 4 次
    401: 1 次
    500: 1 次

?? 最慢的10個(gè)請(qǐng)求（按$request_time排序）：
    2.100s | 500 GET /api/v1/order HTTP/1.1 | IP: 192.168.1.103
    0.089s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.100
    0.045s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.100
    0.033s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.100
    0.022s | 200 GET /api/v1/user HTTP/1.1 | IP: 192.168.1.107
    0.005s | 401 POST /login HTTP/1.1 | IP: 192.168.1.106
    0.002s | 404 GET /api/v1/product HTTP/1.1 | IP: 192.168.1.101
    0.002s | 404 GET /api/v1/product HTTP/1.1 | IP: 192.168.1.105
    0.001s | 404 GET /admin HTTP/1.1 | IP: 192.168.1.102
    0.001s | 404 GET /favicon.ico HTTP/1.1 | IP: 192.168.1.104

?? Top 10 訪問(wèn)IP：
    192.168.1.100: 4 次
    192.168.1.101: 1 次
    192.168.1.102: 1 次
    192.168.1.103: 1 次
    192.168.1.104: 1 次
    192.168.1.105: 1 次
    192.168.1.106: 1 次
    192.168.1.107: 1 次

?? 404錯(cuò)誤最多的URL（前5）：
    GET /api/v1/product HTTP/1.1: 2 次
    GET /admin HTTP/1.1: 1 次
    GET /favicon.ico HTTP/1.1: 1 次

?? 可疑行為檢測(cè)（同一IP在1秒內(nèi)>5次請(qǐng)求）：
    （無(wú)輸出，說(shuō)明沒(méi)有異常）

tail -f /var/log/nginx/error.log

connect() failed (111: Connection refused) while connecting to upstream

# 檢查Java應(yīng)用是否啟動(dòng)
ps aux | grep java

# 檢查端口是否監(jiān)聽(tīng)
netstat -tlnp | grep 8080

# 或者用 ss（推薦）
ss -tlnp | grep 8080

# 如果沒(méi)監(jiān)聽(tīng) → 啟動(dòng)Java應(yīng)用
nohup java -jar your-app.jar > app.log 2>&1 &

grep " 404 " /var/log/nginx/access.log | awk '{print $7}' | sort | uniq -c | sort -nr | head -20

  1200 /wp-admin
   800 /phpmyadmin
   500 /api/v1/user/123456

# 啟用緩沖
proxy_buffering on;
proxy_buffer_size 128k;
proxy_buffers 4 256k;

# 增加超時(shí)
proxy_read_timeout 60s;
proxy_connect_timeout 60s;

# 緩存靜態(tài)資源
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}

sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 3
bantime = 3600

sudo systemctl restart fail2ban

limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;

server {
    location /api/login {
        limit_req zone=login_limit burst=5 nodelay;
        proxy_pass http://backend;
    }
}

# 查看日志大小
ls -lh /var/log/nginx/

# 清空日志（保留文件，清空內(nèi)容）
> /var/log/nginx/access.log

# 或者壓縮歸檔
gzip /var/log/nginx/access.log
mv /var/log/nginx/access.log.gz /var/log/nginx/access.log.20240425.gz

/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
    endscript
}

#!/bin/bash
# /usr/local/bin/nginx-daily-report.sh

LOG_FILE="/var/log/nginx/access.log"
REPORT_FILE="/tmp/nginx-report-$(date +%Y%m%d).txt"

echo "?? Nginx日志日?qǐng)?bào) - $(date)" > $REPORT_FILE
echo "=========================================" >> $REPORT_FILE

# 統(tǒng)計(jì)總請(qǐng)求數(shù)
TOTAL=$(wc -l < $LOG_FILE)
echo "? 總請(qǐng)求數(shù): $TOTAL" >> $REPORT_FILE

# 統(tǒng)計(jì)404
ERROR_404=$(grep " 404 " $LOG_FILE | wc -l)
echo "? 404錯(cuò)誤: $ERROR_404" >> $REPORT_FILE

# 最慢的3個(gè)請(qǐng)求
echo -e "\n?? 最慢的3個(gè)請(qǐng)求：" >> $REPORT_FILE
awk '{print $10, $7}' $LOG_FILE | sort -nr | head -3 >> $REPORT_FILE

# 發(fā)送郵件（需配置sendmail或postfix）
mail -s "Nginx日志日?qǐng)?bào) $(date +%Y-%m-%d)" your-email@example.com < $REPORT_FILE

# 清理
rm $REPORT_FILE

crontab -e

0 8 * * * /usr/local/bin/nginx-daily-report.sh

# Ubuntu安裝GoAccess
sudo apt install goaccess

# 實(shí)時(shí)分析Nginx日志
goaccess /var/log/nginx/access.log --log-format=COMBINED -a

tail -f /var/log/nginx/access.log