Monitor Nginx in Real-Time with ngxtop: Quick Guide & Practical Commands

Scenario

When you need to view Nginx real‑time status information—such as the most frequent requests or IPs with many accesses—you can use ngxtop, a tiny yet powerful tool that analyses the access log and displays data in a top‑like interface.

ngxtop

ngxtop provides real‑time monitoring by parsing Nginx access logs and showing statistics similar to the Unix top command. It only reports the information gathered after the command is started, not a summary of the whole log.

Basic Usage

Run the command: ngxtop The output looks like the screenshot below.

Practical Examples

Show requests that returned 404: ngxtop top request_path --filter 'status == 404' Show requests with the highest response traffic: ngxtop --order-by 'avg(bytes_sent) * count' Show the IP address with the most hits: ngxtop --group-by remote_addr Show 4xx/5xx requests together with status and referer: ngxtop -i 'status >= 400' print request status http_referer Show requests whose path starts with a string, e.g. "/wp":

ngxtop --filter 'request_path.startswith("/wp")'

Parameter Description

-l

: Full path to the log file (defaults to the path defined in nginx.conf). -f: Log format. -t: Refresh interval, default 2 seconds. -g: Group‑by variable, default request_path. -o: Order‑by variable, default count. -h: Show help with detailed options.

Built‑in Variables

You can filter on built‑in variables such as status, remote_addr, request, time_local, http_referer, httpuseragent, etc.

Installation

ngxtop requires pip. Install it with:

sudo pip install ngxtop