Master Real-Time Nginx Log Monitoring with ngxtop on Linux

Linux operations engineers must ensure 24/7 service stability, and monitoring web server logs is essential. While many start with tail -f /path/to/log, using that for multiple sites quickly becomes unwieldy. This article introduces a powerful Nginx log monitoring tool called ngxtop .

ngxtop is a Python‑based program that parses Nginx access logs in real time and outputs useful metrics to the terminal.

Key Features

Current active requests

Total request count summary

Total requests by status code (2xx, 3xx, 4xx, 5xx)

Average bytes sent

Top remote addresses

In addition to real‑time monitoring, ngxtop can also analyze historic logs.

Installing ngxtop on Linux

The following steps were tested on CentOS 7 (64‑bit).

First, install pip (the Python package manager).

Log in to your server with root credentials.

Enable the EPEL repository by installing the following package.

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-6.noarch.rpm
rpm -ivh epel-release-7-6.noarch.rpm

# Install pip
yum install python-pip

# Install ngxtop
pip install ngxtop

Detailed Usage of ngxtop

Usage:

ngxtop [options]
ngxtop [options] (print | top | avg | sum)<var>
ngxtop info

Options:

ngxtop in Practice

1. View request summary, URIs, and status code counts

$ ngxtop

2. Check top client IP addresses

Identify which IPs are sending the most requests to your Nginx server. ngxtop top remote_addr 3. Show only HTTP 404 requests

ngxtop -i'status>= 404'

4. Analyze a specific access.log file ngxtop -l /path/access.log 5. Parse an offline Apache access.log ngxtop -f common -l /path/access.log You can combine various filters to extract the exact data you need from access logs.

GitHub repository: https://github.com/lebinh/ngxtop