Linux三剑客实战-nginx日志分析

拉勾名企直推营 拉勾名企直推营-3期
8

‘’'bash

find_error_log(){

cat ~/ngnix.log | grep 404

cat ~/ngnix.log | grep 500

}

‘’’

9 
find_error_log（）
{
grep 'HTTP/1.1" 404' nginx.log
grep 'HTTP/1.1" 500' nginx.log
}
10 
{
cat nginx.log |awk '{if($9==404 || $9==500) print $0}'
}
11 
find_error_log ()
{
    awk '$9~/404|500/' nginx.log | wc -l
}
12 
find_top_10() { awk '{print $1}' nginx.log| sort | uniq -c | sort -r | head -10 }
13 
find_top_10(){
awk '{print $1}' | sort | uniq -c | sort | awk 'NR=1 {print $1}'
}
14 
find_top_10(){
cat nginx.log | awk -F " " '{print $3}'|sort|uniq -c|sort -nrk 1|awk -F " " '{print $2}' |head -10

}
15 

find_top10 ()
{
    awk '{print $1}' nginx.log | sort | uniq -c | sort -rn | head -10
}
1 个赞
16 
find_top_10() { awk $1 ngnix.log | sort | unique -l | head -10 }
17 
find_top_10()
{
cat xx.txt | awk '{print $1}'| sort |uniq -c|sort -rn|awk 'NR<=10 {print $1}'
}
18 
awk '{print $1} ' nginx.log |sort|uniq -c| awk '{if(NR<=10){print $1}}' nginx.log
20

find_top_10(){
cat nginx.log | awk ‘{print $1}’ | sort | uniq - c | sort - rn | head - 10
}

21 
find_top_10(){
awk '{print$1}' nginx.log | sort |uniq -c|awk '{print$1,$2}'|sort -rn |head -10
}
23 
url_avg_time(){
grep '/topics' nginx.log | awk '{a+=$32}END{print a/NR}'
}
24 
url_avg_time()
{
cat nginx.log |awk 'BEGIN{total=0;count=0} / \/topics / {count+=1;total+=$(NF-1);print total} END{print total/count}'
}
25 
url_avg_time ()
{
    grep --color=auto " /topics " nginx.log | awk '{total+=$(NF-1)}END{print total/NR}'
    awk '/ \/topics /{count+=1;total+=$(NF-1);}END{print $(NF-1),total/count}' nginx.log
}
26 
find_error_log(){
 awk '{if($9=="404") ++sum1;if($9=="500") ++sum2}END{print "404""\t"sum1"\n""500""\t"sum2"\n""error""\t"sum1+sum2}' nginx.log
}
```bash
 find_top_10(){
  awk '{print $1}' nginx.log | sort | uniq -c | sort -nr | head -10
}
```bash
find_before(){
grep -B 2 " 500 " nginx.log 
}
27

题1.思寒老师请问下， 若第一题我这种写法，正确？和您讲的awk 这种差别大吗？find_error_log
grep -nE ’ 404 | 500 ’ nginx.log | less
参考答案：awk ‘$9~/404|500/’ nginx.log
题2.find_top_10
cat nginx.log | awk ‘{print $1}’ | sort | uniq -c | sort -ur | head -10
参考答案：awk ‘{print $1}’ nginx.log |sort | uniq -c | sort -rn | head -10
题3.url_avg_time
没做出来…
参考答案：grep “/topics” nginx.log | awk ‘{total+=$(NF-1);print total/NR}’
grep “/topics” nginx.log | awk ‘{total+=$(NF-1)}END{print total/NR}’
awk ‘/ /topics/ {total+=$(NF-1)}END{print total/NR}’ nginx.log
第三题 还是不太明白

28 
url_avg_time () 
{ 
    awk '$7~/^\/topics$/' nginx.log | awk '{sum += $(NF-1)}; {print $(NF-1) "\t" NR "\t" sum "\t" sum/NR}'
}

find_error_log () 
{ 
    awk '$9~/404|500/' nginx.log
}

find_before_500_after () 
{ 
    grep --color=auto -C 1 ' 500 ' nginx.log
}

find_top_10 () 
{ 
    awk '{print $1}' nginx.log | sort | uniq -c | sort -nr | head -10
}
29 

1. find_error_log () 
{ 
    awk '$9~/404|500/' nginx.log
}
##可以用awk '{print $7,$8,$9}' | head -1 来判断状态码属于哪一列；另外定义函数的时候，func(){ awk xxxxxx;}第一注意大括号和awk之间的空格，第二注意末尾的分号;

2.我的答案find_top_10 () 
{ 
    awk '{print $1}' nginx.log | sort | uniq -c | sort -k 1nr | head -10
}
##sort -k 1 表示根据第一列进行排序
 sort -k 1nr等价于sort -k 1 -nr 

ps. 课上 find_top_10 () 
{ 
    awk '{print $1}' nginx.log | sort | uniq -c | sort -nr | head -10
}


3. 我的答案
url_avg_time () 
{ 
    awk '$7~/^\/topics$/{count+=1;total+=$(NF-1)}END{print total/count}' nginx.log
}
我的思路：
用awk正则匹配/topics，匹配网址列，也就是第七列

 ps.课上所讲的两种方法：
法一：url_avg_time () 
{ 
    grep --color=auto " /topics " nginx.log | awk '{total+=$(NF-1)}END{ print total/NR}'
}
## 加空格是为了保证只过滤 /topics 这个网址

法二：
url_avg_time () 
{ 
    awk '/ \/topics /{count+=1;total+=$(NF-1)}END{print total/count}' nginx.log
}