shell脚本分析nginx日志

shell脚本分析nginx日志：

name=`awk -F ',' '{print $13":"$32}' $file | awk -F ':' '{print $4}'`
echo "name=$name"

awk -F

http://www.cnblogs.com/ggjucheng/archive/2013/01/13/2858470.html

抽取nginx日志access.log中的状态码，然后统计状态码中大于等于200小于300的数量

grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" /data/nginx/logs/access.log | awk -F "[ ]+" 'BEGIN{i=0;print "[start]i=0;"}{if($2>=200&&$2<300){i++}}END{print i?i:0}'

grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" /data/nginx/logs/access.log| awk -F "[ ]+" 'BEGIN{i=0;print "[start]i=0;"}{if($2>=200&&$2<300){i++}else if($2>=300&&$2<400){j++}}END{print i?i:0,j?j:0}'

采用慕课网上的案例：

得不出结果，经过调试发现在CentOS6.5下，if语句和上一个括号之间在同一行就好了：

脚本上用到了数组，grep，awk

#!/bin/sh
# Nginx's log analysis


#控制终端的输出格式
resettem=$(tput sgr0)
#定义日志的路径
Logfile_path='/data/nginx/logs/access.log'
#i=0
#j=1
#grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" /data/nginx/logs/access.log| awk -F "[ ]+" 'BEGIN{i=0;print "[start]i=0;"}{if($2>=200&&$2<300){i++}else if($2>=300&&$2<400){j++}}END{print i?i:0,j?j:0}'

echo "$Logfile_path"


#拿到日志中所有的包含HTTP状态码的部分，拿出第二段来判断，并将结果分配到数组中
grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" $Logfile_path | awk -F "[ ]+" 'BEGIN{i=0;j=0;k=0;n=0;p=0;}{ if($2>=100&&$2<200)     
                  {i++}
           else if($2>=200&&$2<300)
                  {j++}
           else if($2>=300&&$2<400)
                  {k++}
           else if($2>=400&&$2<500)
                  {n++}
           else if($2>=500)
                 {p++}
         }END{
              print i?i:0,j?j:0,k?k:0,n?n:0,p?p:0,i+j+k+n+p
         }'

Check_http_status()
{
#grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" access.log

#拿到日志中所有的包含HTTP状态码的部分，拿出第二段来判断，并将结果分配到数组中

Http_status_codes=(`grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" $Logfile_path | awk -F"[ ]+" 'BEGIN{i=0;j=0;k=0;n=0;p=0;}{ if($2>=100&&$2<200)  {i++} else if($2>=200&&$2<300) {j++} else if($2>=300&&$2<400) {k++} else if($2>=400&&$2<500) {n++} else if($2>=500) {p++} }END{ print i?i:0,j?j:0,k?k:0,n?n:0,p?p:0,i+j+k+n+p }'`)  echo "---------" echo -e 'E[33m'"The number of http status[100+]:" ${resettem} ${Http_status_codes[0]} echo -e 'E[33m'"The number of http status[200+]:" ${resettem} ${Http_status_codes[1]} echo -e 'E[33m'"The number of http status[300+]:" ${resettem} ${Http_status_codes[2]} echo -e 'E[33m'"The number of http status[400+]:" ${resettem} ${Http_status_codes[3]} echo -e 'E[33m'"The number of http status[500+]:" ${resettem} ${Http_status_codes[4]} echo -e 'E[33m'"The number of http all status:" ${resettem} ${Http_status_codes[5]} } Check_http_status

查看具体的状态码，比如403的状态码

grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" /data/nginx/logs/access.log | awk -F "[ ]+"  

'BEGIN{total=0;}{if($2!=""){code[$2]++;total++}else{exit}}END{print code[404]?code[404]:0,code[403]?code[403]:0,total?total:0}'

具体脚本：

Check_http_code()
{
#grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" access.log
Http_Code=(`grep -ioE "HTTP/1.[1|0]"[[:blank:]][0-9]{3}" $Logfile_path | awk -F "[ ]+" 'BEGIN{total=0;}{ if($2!="")        
            {code[$2]++;total++}
        else 
            {exit}
    }END{
        print code[404]?code[404]:0,code[403]?code[403]:0,total}'`)    
echo "---------"
echo -e 'E[33m'"The number of http code[404]:" ${resettem} ${Http_Code[0]}
echo -e 'E[33m'"The number of http code[403]:" ${resettem} ${Http_Code[1]}
echo -e 'E[33m'"The number of http all status:" ${resettem} ${Http_Code[2]}
}
Check_http_code

查看IP来源记录：

nginx默认配置：

log_format  main  '$remote_addr - $remote_user [$time_local] $request '
                      '"$status" $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" $request_time';

    access_log  /var/log/nginx/access.log  main buffer=32k;