dotlinux blog

ngxtop – Monitor Nginx Log Files in Real Time in Linux

In the world of web servers, Nginx is a popular choice due to its high performance and efficiency. Monitoring Nginx log files is crucial for understanding server activity, identifying issues, and optimizing performance. ngxtop is a powerful tool that allows you to monitor Nginx log files in real-time in a Linux environment. In this blog post, we will explore what ngxtop is, how to install it, and how to use it effectively.

2026-05

Table of Contents#

  1. What is ngxtop?
  2. Installation
  3. Basic Usage
  4. Filtering Logs
  5. Aggregation and Statistics
  6. Advanced Features
  7. Conclusion
  8. References

What is ngxtop?#

ngxtop is a command-line tool written in Python that parses Nginx log files and provides a real-time view of the server's activity. It allows you to filter, aggregate, and analyze log data in a convenient way, similar to how top works for system resources. With ngxtop, you can quickly identify patterns, spot errors, and gain insights into your Nginx server's performance.

Installation#

Using pip#

If you have Python's pip package manager installed (usually comes with Python), you can install ngxtop using the following command:

pip install ngxtop

From Source#

Alternatively, you can install ngxtop from its source code. First, clone the repository from GitHub:

git clone https://github.com/lebinh/ngxtop.git
cd ngxtop

Then, install the required dependencies (usually click, pyparsing, etc.) and run the installation script:

python setup.py install

Basic Usage#

Connecting to Log Files#

By default, ngxtop assumes that your Nginx access log is located at /var/log/nginx/access.log. If your log file is in a different location, you can specify it using the --log-format and --log-file options. For example:

ngxtop --log-file /path/to/your/nginx/access.log

If your Nginx log format is different from the default (the common combined format), you need to specify the correct format string. For instance, if you have a custom log format named myformat:

ngxtop --log-format '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"' --log-file /path/to/your/nginx/access.log

Viewing Real-Time Logs#

Once you have connected to the log file, simply run the ngxtop command without any additional options (assuming default settings) to start seeing real-time log entries:

ngxtop

It will display the log entries in a tabular format, showing details like the client IP address (remote_addr), request method (request_method), URL (request_uri), status code (status), and more.

Filtering Logs#

By Status Code#

To filter log entries based on the HTTP status code, you can use the --filter option. For example, to see only 404 (Not Found) errors:

ngxtop --filter'status == 404'

You can also use logical operators. To see both 404 and 500 (Internal Server Error) errors:

ngxtop --filter'status == 404 or status == 500'

By IP Address#

If you want to focus on requests from a specific IP address, say 192.168.1.100:

ngxtop --filter'remote_addr == "192.168.1.100"'

By Request Method#

To view only GET requests:

ngxtop --filter'request_method == "GET"'

Aggregation and Statistics#

Counting Requests#

You can count the number of requests using the count() function. For example, to count the total number of requests:

ngxtop 'count()'

To count requests by status code:

ngxtop'status, count()'

This will group the requests by status code and show the count for each group.

Calculating Response Times#

If your Nginx log includes the $request_time variable (which measures the time taken to serve a request), you can calculate statistics like the average response time. For example:

ngxtop 'avg(request_time)'

You can also calculate the maximum or minimum response time:

ngxtop'max(request_time)'
ngxtop'min(request_time)'

Advanced Features#

Customizing Output Format#

ngxtop allows you to customize the output columns. For example, if you only want to see the client IP, URL, and status code:

ngxtop'remote_addr, request_uri, status'

You can also rename columns. Let's say you want to call the remote_addr column as Client IP:

ngxtop'remote_addr as "Client IP", request_uri, status'

Working with Multiple Log Files#

If you have multiple Nginx log files (e.g., from different virtual hosts), you can monitor them simultaneously. Just specify multiple --log-file options:

ngxtop --log-file /var/log/nginx/access1.log --log-file /var/log/nginx/access2.log

Conclusion#

ngxtop is a valuable tool for anyone managing an Nginx server in a Linux environment. It simplifies the process of monitoring and analyzing Nginx log files in real-time. Whether you're debugging issues, optimizing performance, or just keeping an eye on server activity, ngxtop's filtering, aggregation, and customization features make it a powerful ally. With the knowledge gained from this blog post, you should be able to start using ngxtop effectively to gain insights into your Nginx server's behavior.

References#