实用nginx日志分析脚本

#!/bin/bash
# 通用日志分析脚本

LOG_FILE=${1:-"/var/log/nginx/access.log"}
TIME_RANGE=${2:-"$(date '+%d/%b/%Y')"}

analyze_log() {
    local logfile=$1
    local timerange=$2
    
    echo "=== 分析 $logfile 中 $timerange 的数据 ==="
    
    # 基础统计
    local total_requests=$(grep "$timerange" "$logfile" | wc -l)
    echo "总请求数: $total_requests"
    
    if [ $total_requests -eq 0 ]; then
        echo "没有找到匹配的日志记录"
        return
    fi
    
    # IP统计
    echo "TOP 10 访问IP:"
    grep "$timerange" "$logfile" | \
    awk '{print $1}' | \
    sort | uniq -c | \
    sort -nr | head -10 | \
    awk '{printf "%-15s %8d 次\n", $2, $1}'
    
    # 状态码统计
    echo "状态码分布:"
    grep "$timerange" "$logfile" | \
    awk '{status[$9]++} END {
        for (code in status) {
            printf "%-5s %8d 次 (%.2f%%)\n", 
                   code, status[code], status[code]*100/NR
        }
    }' | sort -k2 -nr
    
    # 错误分析
    local error_count=$(grep "$timerange" "$logfile" | grep -cE " (4[0-9]{2}|5[0-9]{2}) ")
    if [ $error_count -gt 0 ]; then
        echo "错误请求分析 (总计: $error_count):"
        grep "$timerange" "$logfile" | \
        grep -E " (4[0-9]{2}|5[0-9]{2}) " | \
        awk '{print $1, $7, $9}' | \
        sort | uniq -c | \
        sort -nr | head -10 | \
        awk '{printf "%-15s %-30s %s (%d次)\n", $2, $3, $4, $1}'
    fi
    
    # 流量统计
    echo "流量统计:"
    grep "$timerange" "$logfile" | \
    awk '{
        bytes += $10
        if ($10 > max_bytes) {
            max_bytes = $10
            max_url = $7
        }
    } END {
        printf "总流量: %.2f MB\n", bytes/1024/1024
        printf "平均请求大小: %.2f KB\n", bytes/1024/NR
        printf "最大请求: %s (%.2f MB)\n", max_url, max_bytes/1024/1024
    }'
}

analyze_log "$LOG_FILE" "$TIME_RANGE"