ngxtop is a free, open-source, flexible, and real-time monitoring tool for Nginx web servers. It efficiently parses Nginx access logs and provides detailed insights into request counts, requested URIs, and requests sorted by status code, among other metrics. It’s a straightforward and user-friendly tool for overseeing requests to an Nginx web server.
In this guide, I will demonstrate how to install and utilize the ngxtop monitoring tool on Ubuntu 24.04.
Prerequisites
- A server running Ubuntu 24.04.
- Root access configured on your server.
Installing ngxtop
Since ngxtop is a Python-based tool, both Python and PIP packages need to be installed on your system. Execute the following command to install them along with Nginx:
apt-get install nginx python3 python3-pip -y
Afterwards, install the ngxtop package using PIP with this command:
pip3 install ngxtop
Once installed, verify the ngxtop version using the following command:
ngxtop --version
You should receive an output similar to:
xstat 0.1
Using ngxtop
This section guides you on leveraging ngxtop to monitor the Nginx web server.
Simply executing the ngxtop command will display a summary of request counts, requested URIs, and request count by status code:
ngxtop
Here’s the expected output:
To specify the access log file you wish to analyze, use the -l option:
ngxtop -l /var/log/nginx/access.log
Expected screen capture:
To view the top IP addresses accessing your Nginx server, use the following command:
ngxtop --group-by remote_addr -l /var/log/nginx/access.log
Expected screen capture:
Print the top 10 requests with the highest total bytes sent using:
ngxtop --order-by 'avg(bytes_sent) * count' -l /var/log/nginx/access.log
Expected screen capture:
ngxtop also supports parsing Apache log files from a remote server with this command:
ssh root@remote-server-ip tail -f /var/log/apache2/access.log | ngxtop -f common
To list all available options with ngxtop, execute:
ngxtop --help
The output includes:
ngxtop - ad-hoc query for nginx access log.
Usage:
ngxtop [options]
ngxtop [options] (print|top|avg|sum) ...
ngxtop info
ngxtop [options] query ...
Options:
-l , --access-log access log file to parse.
-f , --log-format log format as specify in log_format directive. [default: combined]
--no-follow ngxtop default behavior is to ignore the current lines in log
and only watch for new lines as they're written to the access log.
Use this flag to tell ngxtop to process the current content of the access log instead.
-t , --interval report interval when running in follow mode [default: 2.0]
-g , --group-by group by variable [default: request_path]
-w , --having having clause [default: 1]
-o , --order-by order of output for the default query [default: count]
-n , --limit limit the number of records included in report for the top command [default: 10]
-a ..., --a ... add exp (must be aggregation exp: sum, avg, min, max, etc.) into output
-v, --verbose more verbose output
-d, --debug print every line and parsed record
-h, --help print this help message.
--version print version information.
Advanced / experimental options:
-c , --config allow ngxtop to parse nginx config file for log format and location.
-i , --filter filter in, records satisfied given expression are processed.
-p , --pre-filter in-filter expression to check in pre-parsing phase.
Examples:
All examples read nginx config file for access log location and format.
If you want to specify the access log file and/or log format, use the -f and -a options.
"top" like view of nginx requests
$ ngxtop
Top 10 requested path with status 404:
$ ngxtop top request_path --filter 'status == 404'
Top 10 requests with highest total bytes sent
$ ngxtop --order-by 'avg(bytes_sent) * count'
Top 10 remote address, e.g., who's hitting you the most
$ ngxtop --group-by remote_addr
Print requests with 4xx or 5xx status, together with status and HTTP referrer
$ ngxtop -i 'status >= 400' print request status http_referer
Average body bytes sent of 200 responses of requested path begin with 'foo':
$ ngxtop avg bytes_sent --filter 'status == 200 and request_path.startswith("foo")'
Analyze apache access log from remote machine using 'common' log format
$ ssh remote tail -f /var/log/apache2/access.log | ngxtop -f common
Conclusion
This guide has walked you through installing and using ngxtop on Ubuntu 20.04, enabling you to efficiently monitor your Nginx logs from the command-line interface.
Frequently Asked Questions
What is ngxtop?
ngxtop is a real-time monitoring tool for Nginx web servers that parses access logs to provide detailed insights into various metrics such as request counts and URI requests.
Can ngxtop parse Apache logs?
Yes, ngxtop can parse Apache log files from a remote server using SSH and piping the log output to ngxtop.
Do I need special permissions to install ngxtop?
You will need root or sudo access to install packages and modify configurations on your server.
Is ngxtop specific to Ubuntu 24.04?
No, while this guide outlines installation on Ubuntu 24.04, ngxtop can be installed on other Linux distributions. Ensure Python and PIP are available for other distributions.