تحلیل لاگ nginx با awk و GoAccess

# در بلوک http
log_format timed '$remote_addr - $remote_user [$time_local] "$request" '
                 '$status $body_bytes_sent "$http_referer" '
                 '"$http_user_agent" rt=$request_time urt=$upstream_response_time';

# در server block
access_log /var/log/nginx/example.com.access.log timed;

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -15

awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

awk '$9 == 404 {print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

grep -oP 'rt=\K[0-9.]+' /var/log/nginx/example.com.access.log | sort -rn | head
awk -F'rt=' '{split($2,a," "); if (a[1] > 2) print $0}' /var/log/nginx/example.com.access.log | head

grep '29/Sep/2026:10:' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head
grep -i googlebot /var/log/nginx/access.log | awk '{print $9}' | sort | uniq -c

sudo apt install -y goaccess
sudo goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/report.html

# لاگ‌های فشرده هم
zcat /var/log/nginx/access.log.*.gz | goaccess - --log-format=COMBINED

cat /etc/logrotate.d/nginx
sudo logrotate -d /etc/logrotate.d/nginx