Nginx學習筆記3-Nginx日誌變量以及常見模塊

1.HTTP請求

yum -y install curl

客戶端---------request----->服務端

服務端--------response---->客戶端

request包含請求行,請求頭部、請求數據

response包含狀態行、消息報頭、響應正文

使用linux發送http請求:

curl www.baidu.com
如果沒有curl的話需要先安裝curl

yum -y install curl
[root@VM_69_65_centos ~]# curl www.baidu.com
<!DOCTYPE html>
<!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge><meta content=always name=referrer><link rel=stylesheet type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css><title>百度一下,你就知道</title></head> <body link=#0000cc> <div id=wrapper> <div id=head> <div class=head_wrapper> <div class=s_form> <div class=s_form_wrapper> <div id=lg> <img hidefocus=true src=//www.baidu.com/img/bd_logo1.png width=270 height=129> </div> <form id=form name=f action=//www.baidu.com/s class=fm> <input type=hidden name=bdorz_come value=1> <input type=hidden name=ie value=utf-8> <input type=hidden name=f value=8> <input type=hidden name=rsv_bp value=1> <input type=hidden name=rsv_idx value=1> <input type=hidden name=tn value=baidu><span class="bg s_ipt_wr"><input id=kw name=wd class=s_ipt value maxlength=255 autocomplete=off autofocus></span><span class="bg s_btn_wr"><input type=submit id=su value=百度一下 class="bg s_btn"></span> </form> </div> </div> <div id=u1> <a href=http://news.baidu.com name=tj_trnews class=mnav>新聞</a> <a href=http://www.hao123.com name=tj_trhao123 class=mnav>hao123</a> <a href=http://map.baidu.com name=tj_trmap class=mnav>地圖</a> <a href=http://v.baidu.com name=tj_trvideo class=mnav>視頻</a> <a href=http://tieba.baidu.com name=tj_trtieba class=mnav>貼吧</a> <noscript> <a href=http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u=http%3A%2F%2Fwww.baidu.com%2f%3fbdorz_come%3d1 name=tj_login class=lb>登錄</a> </noscript> <script>document.write('<a href="http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u='+ encodeURIComponent(window.location.href+ (window.location.search === "" ? "?" : "&")+ "bdorz_come=1")+ '" name="tj_login" class="lb">登錄</a>');</script> <a href=//www.baidu.com/more/ name=tj_briicon class=bri style="display: block;">更多產品</a> </div> </div> </div> <div id=ftCon> <div id=ftConw> <p id=lh> <a href=http://home.baidu.com>關於百度</a> <a href=http://ir.baidu.com>About Baidu</a> </p> <p id=cp>&copy;2017 Baidu <a href=http://www.baidu.com/duty/>使用百度前必讀</a>  <a href=http://jianyi.baidu.com/ class=cp-feedback>意見反饋</a> 京ICP證030173號  <img src=//www.baidu.com/img/gs.gif> </p> </div> </div> </div> </body> </html>
這樣請求只能看到請求正文,我們想要看到的更多就要用到

curl -v  www.baidu.com

[root@VM_69_65_centos ~]# curl -v  www.baidu.com
* About to connect() to www.baidu.com port 80 (#0)
*  Trying 180.149.131.98...
* Connected to www.baidu.com (180.149.131.98) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.baidu.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: bfe/1.0.8.18
< Date: Tue, 16 Jan 2018 06:11:06 GMT
< Content-Type: text/html
< Content-Length: 2381
< Last-Modified: Mon, 23 Jan 2017 13:27:36 GMT
< Connection: Keep-Alive
< ETag: "588604c8-94d"
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Pragma: no-cache
< Set-Cookie: BDORZ=27315; max-age=86400; domain=.baidu.com; path=/
< Accept-Ranges: bytes
< 
<!DOCTYPE html>
<!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge><meta content=always name=referrer><link rel=stylesheet type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css><title>百度一下,你就知道</title></head> <body link=#0000cc> <div id=wrapper> <div id=head> <div class=head_wrapper> <div class=s_form> <div class=s_form_wrapper> <div id=lg> <img hidefocus=true src=//www.baidu.com/img/bd_logo1.png width=270 height=129> </div> <form id=form name=f action=//www.baidu.com/s class=fm> <input type=hidden name=bdorz_come value=1> <input type=hidden name=ie value=utf-8> <input type=hidden name=f value=8> <input type=hidden name=rsv_bp value=1> <input type=hidden name=rsv_idx value=1> <input type=hidden name=tn value=baidu><span class="bg s_ipt_wr"><input id=kw name=wd class=s_ipt value maxlength=255 autocomplete=off autofocus></span><span class="bg s_btn_wr"><input type=submit id=su value=百度一下 class="bg s_btn"></span> </form> </div> </div> <div id=u1> <a href=http://news.baidu.com name=tj_trnews class=mnav>新聞</a> <a href=http://www.hao123.com name=tj_trhao123 class=mnav>hao123</a> <a href=http://map.baidu.com name=tj_trmap class=mnav>地圖</a> <a href=http://v.baidu.com name=tj_trvideo class=mnav>視頻</a> <a href=http://tieba.baidu.com name=tj_trtieba class=mnav>貼吧</a> <noscript> <a href=http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u=http%3A%2F%2Fwww.baidu.com%2f%3fbdorz_come%3d1 name=tj_login class=lb>登錄</a> </noscript> <script>document.write('<a href="http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u='+ encodeURIComponent(window.location.href+ (window.location.search === "" ? "?" : "&")+ "bdorz_come=1")+ '" name="tj_login" class="lb">登錄</a>');</script> <a href=//www.baidu.com/more/ name=tj_briicon class=bri style="display: block;">更多產品</a> </div> </div> </div> <div id=ftCon> <div id=ftConw> <p id=lh> <a href=http://home.baidu.com>關於百度</a> <a href=http://ir.baidu.com>About Baidu</a> </p> <p id=cp>&copy;2017 Baidu <a href=http://www.baidu.com/duty/>使用百度前必讀</a>  <a href=http://jianyi.baidu.com/ class=cp-feedback>意見反饋</a> 京ICP證030173號  <img src=//www.baidu.com/img/gs.gif> </p> </div> </div> </div> </body> </html>
* Connection #0 to host www.baidu.com left intact
映射到空設備上
[root@VM_69_65_centos ~]# curl -v  www.baidu.com > /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* About to connect() to www.baidu.com port 80 (#0)
*   Trying 61.135.169.125...
* Connected to www.baidu.com (61.135.169.125) port 80 (#0)
> GET / HTTP/1.1                  //請求行 GET爲請求方法 後面是請求的協議
> User-Agent: curl/7.29.0         //head的內容
> Host: www.baidu.com		  //報文信息
> Accept: */*
> 
< HTTP/1.1 200 OK 		//200狀態碼 OK報文
< Server: bfe/1.0.8.18
< Date: Tue, 16 Jan 2018 06:12:02 GMT
< Content-Type: text/html
//響應的head的信息
< Content-Length: 2381
< Last-Modified: Mon, 23 Jan 2017 13:27:29 GMT
< Connection: Keep-Alive
< ETag: "588604c1-94d"
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Pragma: no-cache
< Set-Cookie: BDORZ=27315; max-age=86400; domain=.baidu.com; path=/
< Accept-Ranges: bytes
< 
{ [data not shown]
100  2381  100  2381    0     0   134k      0 --:--:-- --:--:-- --:--:--  136k
* Connection #0 to host www.baidu.com left intact
[root@VM_69_65_centos ~]# 

2、Nginx日誌類型

包括:error.log access_log
error.log記錄處理http請求的錯誤狀態以及Nginx本身服務的錯誤狀態。
access_log記錄Nginx每一次請求的訪問狀態

nginx服務器日誌相關指令主要有兩條,一條是log_format,用來設置日誌格式,另外一條是access_log,用來指定日誌文件的存放路徑、格式和緩存大小,一般在nginx的配置文件中日記配置(/usr/local/nginx/conf/nginx.conf)。

nginx的log_format有很多可選的參數用於指示服務器的活動狀態,默認的是:
log_format  access  '$remote_addr - $remote_user [$time_local] "$request" '    '$status $body_bytes_sent "$http_referer" '    '"$http_user_agent" "$http_x_forwarded_for"';


log_format的配置語法:
log_format
Syntax:log_format name[escape=default|json] string ...;
Default:logformat combined"...";
Context:http

我們去查看Nginx的log配置
路徑:/etc/nginx/nginx.conf
user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;   //配置nginx錯誤日誌的地方 warn是錯誤日誌的級別(warn以上的錯誤記錄)
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    //$後面代表Nginx的變量
    access_log  /var/log/nginx/access.log  main;  //access_log的路徑 main表示以main的格式來標識日誌

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

以下爲error.log

2018/01/15 20:50:13 [error] 30536#30536: *1 open() "/usr/share/nginx/html/favicon.ico" failed (2: No such file or directory), client: 36.106.176.206, server: localhost, request: "GET /favicon.ico HTTP/1.1", host: "211.159.168.30"
2018/01/16 00:06:45 [error] 30536#30536: *10 open() "/usr/share/nginx/html/hndUnblock.cgi" failed (2: No such file or directory), client: 189.62.120.171, server: localhost, request: "GET /hndUnblock.cgi HTTP/1.1", host: "211.159.168.30"
2018/01/16 00:06:48 [error] 30536#30536: *11 open() "/usr/share/nginx/html/tmUnblock.cgi" failed (2: No such file or directory), client: 189.62.120.171, server: localhost, request: "GET /tmUnblock.cgi HTTP/1.1", host: "211.159.168.30"
2018/01/16 00:06:51 [error] 30536#30536: *12 open() "/usr/share/nginx/html/moo" failed (2: No such file or directory), client: 189.62.120.171, server: localhost, request: "GET /moo HTTP/1.1", host: "211.159.168.30"
2018/01/16 00:06:58 [error] 30536#30536: *14 open() "/usr/share/nginx/html/getcfg.php" failed (2: No such file or directory), client: 189.62.120.171, server: localhost, request: "POST /getcfg.php HTTP/1.1", host: "211.159.168.30"
2018/01/16 00:07:05 [error] 30536#30536: *15 open() "/usr/share/nginx/html/getcfg.php" failed (2: No such file or directory), client: 189.62.120.171, server: localhost, request: "POST /getcfg.php HTTP/1.1", host: "211.159.168.30"
2018/01/16 00:32:05 [error] 30536#30536: *16 open() "/usr/share/nginx/html/azenv.php" failed (2: No such file or directory), client: 95.213.187.190, server: localhost, request: "POST http://check.best-proxies.ru/azenv.php?auth=151603392515&a=PSCN&i=3550455838&p=80 HTTP/1.1", host: "check.best-proxies.ru", referrer: "http://best-proxies.ru/"
2018/01/16 02:18:28 [error] 30536#30536: *19 open() "/usr/share/nginx/html/echo.php" failed (2: No such file or directory), client: 139.162.88.63, server: localhost, request: "GET http://clientapi.ipip.net/echo.php?info=1234567890 HTTP/1.1", host: "clientapi.ipip.net"
2018/01/16 06:07:15 [error] 30536#30536: *24 open() "/usr/share/nginx/html/404/search_children.js" failed (2: No such file or directory), client: 120.132.3.65, server: localhost, request: "GET http://www.qq.com/404/search_children.js HTTP/1.1", host: "www.qq.com"
2018/01/16 06:38:59 [error] 30536#30536: *25 open() "/usr/share/nginx/html/webconfig.ini" failed (2: No such file or directory), client: 205.209.159.44, server: localhost, request: "GET /webconfig.ini HTTP/1.1", host: "211.159.168.30"
2018/01/16 08:20:52 [error] 30536#30536: *26 open() "/usr/share/nginx/html/azenv.php" failed (2: No such file or directory), client: 95.213.187.189, server: localhost, request: "POST http://check.best-proxies.ru/azenv.php?auth=151606205281&a=PSCN&i=3550455838&p=80 HTTP/1.1", host: "check.best-proxies.ru", referrer: "http://best-proxies.ru/"
2018/01/16 10:51:12 [error] 30536#30536: *32 open() "/usr/share/nginx/html/index.action" failed (2: No such file or directory), client: 58.218.201.54, server: localhost, request: "GET /index.action HTTP/1.1", host: "211.159.168.30"
2018/01/16 11:57:11 [error] 30536#30536: *33 open() "/usr/share/nginx/html/manager/html" failed (2: No such file or directory), client: 218.93.201.199, server: localhost, request: "GET /manager/html HTTP/1.1", host: "211.159.168.30:80"
2018/01/16 13:30:24 [error] 30536#30536: *34 open() "/usr/share/nginx/html/forum.php" failed (2: No such file or directory), client: 106.120.160.119, server: localhost, request: "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1", host: "211.159.168.30", referrer: "http://211.159.168.30/forum.php?mod=forumdisplay&fid=2"
2018/01/16 13:30:56 [error] 30536#30536: *36 open() "/usr/share/nginx/html/forum.php" failed (2: No such file or directory), client: 220.181.132.198, server: localhost, request: "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1", host: "211.159.168.30"
2018/01/16 13:30:56 [error] 30536#30536: *37 open() "/usr/share/nginx/html/forum.php" failed (2: No such file or directory), client: 171.13.14.145, server: localhost, request: "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1", host: "211.159.168.30"
2018/01/16 13:31:10 [error] 30536#30536: *38 open() "/usr/share/nginx/html/forum.php" failed (2: No such file or directory), client: 182.118.20.158, server: localhost, request: "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1", host: "211.159.168.30"
2018/01/16 13:31:18 [error] 30536#30536: *39 open() "/usr/share/nginx/html/forum.php" failed (2: No such file or directory), client: 182.118.20.145, server: localhost, request: "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1", host: "211.159.168.30"
2018/01/16 13:31:23 [error] 30536#30536: *40 open() "/usr/share/nginx/html/forum.php" failed (2: No such file or directory), client: 182.118.20.149, server: localhost, request: "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1", host: "211.159.168.30"
2018/01/16 14:40:23 [error] 30536#30536: *41 open() "/usr/share/nginx/html/home.php" failed (2: No such file or directory), client: 106.120.161.66, server: localhost, request: "GET /home.php HTTP/1.1", host: "211.159.168.30", referrer: "http://211.159.168.30/home.php"
2018/01/16 14:40:46 [error] 30536#30536: *42 open() "/usr/share/nginx/html/home.php" failed (2: No such file or directory), client: 101.199.108.53, server: localhost, request: "GET /home.php HTTP/1.1", host: "211.159.168.30"
2018/01/16 14:41:26 [error] 30536#30536: *43 open() "/usr/share/nginx/html/home.php" failed (2: No such file or directory), client: 171.13.14.145, server: localhost, request: "GET /home.php HTTP/1.1", host: "211.159.168.30"
2018/01/16 14:42:00 [error] 30536#30536: *44 open() "/usr/share/nginx/html/home.php" failed (2: No such file or directory), client: 171.13.14.132, server: localhost, request: "GET /home.php HTTP/1.1", host: "211.159.168.30"
2018/01/16 14:42:00 [error] 30536#30536: *45 open() "/usr/share/nginx/html/home.php" failed (2: No such file or directory), client: 171.13.14.151, server: localhost, request: "GET /home.php HTTP/1.1", host: "211.159.168.30"


以下爲access.log


36.106.176.206 - - [15/Jan/2018:20:50:13 +0800] "GET /favicon.ico HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36" "-"
36.106.176.206 - - [15/Jan/2018:20:50:14 +0800] "GET / HTTP/1.1" 200 555 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" "-"
106.120.161.66 - - [15/Jan/2018:20:51:04 +0800] "GET / HTTP/1.1" 200 555 "http://211.159.168.30/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)" "-"
220.181.132.195 - - [15/Jan/2018:20:51:32 +0800] "GET / HTTP/1.1" 200 555 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-"
187.106.44.13 - - [15/Jan/2018:20:54:48 +0800] "t3 12.2.1" 400 173 "-" "-" "-"
189.62.120.171 - - [16/Jan/2018:00:06:45 +0800] "GET /hndUnblock.cgi HTTP/1.1" 404 169 "-" "Wget(linux)" "-"
189.62.120.171 - - [16/Jan/2018:00:06:48 +0800] "GET /tmUnblock.cgi HTTP/1.1" 404 169 "-" "Wget(linux)" "-"
189.62.120.171 - - [16/Jan/2018:00:06:51 +0800] "GET /moo HTTP/1.1" 404 169 "-" "Wget(linux)" "-"
189.62.120.171 - - [16/Jan/2018:00:06:54 +0800] "GET / HTTP/1.1" 200 555 "-" "Wget(linux)" "-"
189.62.120.171 - - [16/Jan/2018:00:06:58 +0800] "POST /getcfg.php HTTP/1.1" 404 169 "-" "Wget(linux)" "-"
189.62.120.171 - - [16/Jan/2018:00:07:05 +0800] "POST /getcfg.php HTTP/1.1" 404 169 "-" "Wget(linux)" "-"
95.213.187.190 - - [16/Jan/2018:00:32:05 +0800] "POST http://check.best-proxies.ru/azenv.php?auth=151603392515&a=PSCN&i=3550455838&p=80 HTTP/1.1" 404 571 "http://best-proxies.ru/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" "-"
205.209.159.44 - - [16/Jan/2018:00:39:29 +0800] "GET / HTTP/1.1" 200 555 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" "-"
47.93.112.232 - - [16/Jan/2018:01:29:16 +0800] "GET / HTTP/1.1" 200 555 "-" "-" "-"
139.162.88.63 - - [16/Jan/2018:02:18:28 +0800] "GET http://clientapi.ipip.net/echo.php?info=1234567890 HTTP/1.1" 404 169 "-" "Go-http-client/1.1" "-"
104.236.182.189 - - [16/Jan/2018:03:02:48 +0800] "GET / HTTP/1.1" 200 555 "-" "Mozilla/5.0 zgrab/0.x" "-"
120.132.3.65 - - [16/Jan/2018:06:07:15 +0800] "GET http://www.qq.com/404/search_children.js HTTP/1.1" 404 571 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" "-"
120.132.3.65 - - [16/Jan/2018:06:07:15 +0800] "\x04\x01\x00PpTi4\x00" 400 173 "-" "-" "-"
120.132.3.65 - - [16/Jan/2018:06:07:15 +0800] "\x05\x01\x00" 400 173 "-" "-" "-"
205.209.159.44 - - [16/Jan/2018:06:38:59 +0800] "GET /webconfig.ini HTTP/1.1" 404 169 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" "-"
95.213.187.189 - - [16/Jan/2018:08:20:52 +0800] "POST http://check.best-proxies.ru/azenv.php?auth=151606205281&a=PSCN&i=3550455838&p=80 HTTP/1.1" 404 571 "http://best-proxies.ru/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" "-"
47.93.90.175 - - [16/Jan/2018:09:34:09 +0800] "GET / HTTP/1.1" 200 555 "-" "-" "-"
123.59.146.153 - - [16/Jan/2018:10:15:57 +0800] "\x16\x03\x01\x01\x22\x01\x00\x01\x1E\x03\x03\xDA\xF2\x07\x92\x89\xD5\x16\xD0\xA8\x03\xA8\xEA\xDE\x95\xF7\x90\xDF\x98\x11\xB2\x01\xB5v\x0F\x13be\xAF^\xD3\xC56\x00\x00\x88\xC00\xC0,\xC0(\xC0$\xC0\x14\xC0" 400 173 "-" "-" "-"
123.59.146.153 - - [16/Jan/2018:10:16:05 +0800] "USER test +iw test :Test Wuz Here" 400 173 "-" "-" "-"
123.59.146.153 - - [16/Jan/2018:10:16:05 +0800] "GET / HTTP/1.1" 200 555 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" "-"
58.218.201.54 - - [16/Jan/2018:10:51:12 +0800] "GET / HTTP/1.1" 200 555 "-" "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705" "-"
58.218.201.54 - - [16/Jan/2018:10:51:12 +0800] "GET /index.action HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" "-"
218.93.201.199 - - [16/Jan/2018:11:57:11 +0800] "GET /manager/html HTTP/1.1" 404 571 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" "-"
106.120.160.119 - - [16/Jan/2018:13:30:24 +0800] "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1" 404 571 "http://211.159.168.30/forum.php?mod=forumdisplay&fid=2" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)" "-"
220.181.132.180 - - [16/Jan/2018:13:30:41 +0800] "GET / HTTP/1.1" 200 555 "http://211.159.168.30/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-"
220.181.132.198 - - [16/Jan/2018:13:30:56 +0800] "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-"
171.13.14.145 - - [16/Jan/2018:13:30:56 +0800] "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "unknown"
182.118.20.158 - - [16/Jan/2018:13:31:10 +0800] "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "unknown"
182.118.20.145 - - [16/Jan/2018:13:31:18 +0800] "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "unknown"
182.118.20.149 - - [16/Jan/2018:13:31:23 +0800] "GET /forum.php?mod=forumdisplay&fid=2 HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "unknown"
106.120.161.66 - - [16/Jan/2018:14:40:23 +0800] "GET /home.php HTTP/1.1" 404 571 "http://211.159.168.30/home.php" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)" "-"
101.199.108.53 - - [16/Jan/2018:14:40:46 +0800] "GET /home.php HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-"
171.13.14.145 - - [16/Jan/2018:14:41:26 +0800] "GET /home.php HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "unknown"
171.13.14.132 - - [16/Jan/2018:14:42:00 +0800] "GET /home.php HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "unknown"
171.13.14.151 - - [16/Jan/2018:14:42:00 +0800] "GET /home.php HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "unknown"
95.76.223.173 - - [16/Jan/2018:15:09:35 +0800] "GET / HTTP/1.0" 200 555 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" "-"

3、Nginx變量

Http請求變量 

arg_PARAMETER(請求參數)、http_HEADER(請求頭)、sent_http_HEADER(服務端返回的response的響應頭)
舉個例子:
[root@VM_69_65_centos ~]# curl -v www.baidu.com >/dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* About to connect() to www.baidu.com port 80 (#0)
*   Trying 220.181.112.244...
* Connected to www.baidu.com (220.181.112.244) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0 //這裏證明request使用的是curl,用的是7.29.0的版本進行的請求
如果想要讓日誌記錄User-Agent我們需要修改nginx.conf(/etc/nginx/nginx.conf)配置文件
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;


    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

//修改上面這一段,下面爲修改後的結果
修改時需要注意每一個字母都要小寫,而且-要改爲下劃線_
log_format  main  '$http_user_agent' '$remote_addr - $remote_user [$time_local] "$request" '
           '$status $body_bytes_sent "$http_referer" '
          '"$http_user_agent" "$http_x_forwarded_for"';


    access_log  /var/log/nginx/access.log  main;


    sendfile        on;
    #tcp_nopush     on;


    keepalive_timeout  65;


    #gzip  on;


    include /etc/nginx/conf.d/*.conf;
}
> Host: www.baidu.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: bfe/1.0.8.18
< Date: Tue, 16 Jan 2018 07:38:26 GMT
< Content-Type: text/html
< Content-Length: 2381
< Last-Modified: Mon, 23 Jan 2017 13:27:36 GMT
< Connection: Keep-Alive
< ETag: "588604c8-94d"
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Pragma: no-cache
< Set-Cookie: BDORZ=27315; max-age=86400; domain=.baidu.com; path=/
< Accept-Ranges: bytes
< 
{ [data not shown]
100  2381  100  2381    0     0   119k      0 --:--:-- --:--:-- --:--:--  122k
* Connection #0 to host www.baidu.com left intact
[root@VM_69_65_centos ~]# 

之後我們使用
[root@VM_69_65_centos ~]# nginx -t -c /etc/nginx/nginx.conf
查看日誌是否正確
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
之後我們再使用curl請本機127.0.0.1然後我們查看access.log










127.0.0.1 - - [16/Jan/2018:15:52:02 +0800] "GET / HTTP/1.1" 200 555 "-" "curl/7.29.0" "-"
127.0.0.1 - - [16/Jan/2018:15:52:09 +0800] "GET / HTTP/1.1" 200 555 "-" "curl/7.29.0" "-"
127.0.0.1 - - [16/Jan/2018:15:52:10 +0800] "GET / HTTP/1.1" 200 555 "-" "curl/7.29.0" "-"
127.0.0.1 - - [16/Jan/2018:15:52:10 +0800] "GET / HTTP/1.1" 200 555 "-" "curl/7.29.0" "-"
之後我們發現配置生效



內置變量-Nginx內置

nginx的官網查看
http://nginx.org/en/docs/
http://nginx.org/en/docs/syslog.html
http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log

之後我們來看一下nginx默認的log_format有哪些
  log_format  main  '$http_user_agent' '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
參數 說明 示例
$remote_addr 客戶端地址 211.28.65.253
$remote_user 客戶端用戶名稱不開啓認證模塊沒用 --
$time_local 訪問時間和時區 18/Jul/2012:17:00:01 +0800
$request 請求的URI和HTTP協議 "GET /article-10000.html HTTP/1.1"
$http_host 請求地址,即瀏覽器中你輸入的地址(IP或域名)
192.168.100.100
$status HTTP請求狀態 200
$upstream_status upstream狀態 200
$body_bytes_sent 發送給客戶端文件內容大小 1547
$http_referer url跳轉來源(上一級頁面是哪個,做防盜鏈可用) https://www.baidu.com/
$http_user_agent 用戶終端瀏覽器等信息(可以記錄客戶端用什麼來訪問的,比如說IE,curl) "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; GTB7.0; .NET4.0C;
$ssl_protocol SSL協議版本 TLSv1
$ssl_cipher 交換數據中的算法 RC4-SHA
$upstream_addr 後臺upstream的地址,即真正提供服務的主機地址 10.10.10.100:80
$request_time 整個請求的總時間 0.205
$upstream_response_time 請求過程中,upstream響應時間 0.002



自定義變量 -自己定義


以後再說。


四、Nginx模塊講解

Nginx官方模塊

     Nginx中文文檔:http://www.nginx.cn/doc/ 


   
[root@VM_69_65_centos ~]# nginx -V
查看nginx編譯信息
nginx version: nginx/1.12.2
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'

--with-http_stub_status_module  Nginx的客戶端狀態

配置:
Syntax:stub_status;
Default:-(無默認)
Context:server,location(基於server或location下進行配置)
進入/etc/nginx/nginx.d/default.conf(默認配置) 其實這裏配置的是訪問路徑,我們把這個模塊放入了訪問路徑中了。

server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
	
   
location /zjlstatus{ //這裏的是自定義名
   stub_status;
}


    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}

之後我們驗證nginx.conf的正確性





nginx -tc /etc/nginx/nginx.conf        
然後我們重載服務
nginx -s reload -c /etc/nginx/nginx.conf
之後我們打開我們的服務器路徑
http://211.159.XXX.XX/zjlstatus
Active connections: 5    //nginx當前活躍的連接數
server accepts handled requests 
 62 62 51  //第一個表示nginx握手的總的次數,第二個標識nginx所處理的連接數, 最後一個標識請求數
Reading: 0 Writing: 1 Waiting: 4 //第一個標識讀的個數,第二個表示寫的數目,第三個標識等待的數目

-with-http_random_index_module 目錄中選擇一個隨機主頁


Syntax:random_index on|off;
Default: random_index off;(默認off)
Context:local(只能配置在local下)
 

繼續修改default.conf
我們將修改
 location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

修改後爲
 location / {
        root   /opt/app/code;
        #index  index.html index.htm; #以後還是用正經註釋吧。這裏先把主頁註釋掉
	#之後添加隨機主頁
	random_index on;
    }


nginx -tc /etc/nginx/nginx.conf
systemctl reload rsyslog.service
systemctl reload nginx
nginx -s reload -c /etc/nginx/nginx.conf

目錄下要加入三個主頁(html),用於測試
我們進入這個目錄並且將其設置爲家目錄(~)

/opt/app/code/
pwd
最後我們訪問我們的主頁,就會發現主頁是隨機的了。
這裏需要注意,隨機主頁不能是以.開頭的文件(.開頭文件在linux中算是隱藏文件)

--with-http_sub_module HTTP內容替換

列舉一些常見的使用:
Syntax:sub_filter string(替換前的字符串) replacement(替換後的字符串);
Default:-
Context:http,server,location

Syntax:sub_filter_last_modified on|off  (校驗服務端的內容是否有發生過變更,判斷是否有更新)
Default: sub_filter_last_modified off;
Context:http,server,location

Syntax:sub_filter_once on|off  (on只匹配第一個,OFF匹配所有指定內容)
Default: sub_filter_once on;
Context:http,server,location

 location / {
        root   /opt/app/code;
        index  index.html index.htm;
		
	sub_filter '要替換的'  '替換成什麼';
    
sub_filter_last_modified on;#檢測更新
sub_filter_once off;#全局替換
}

Nginx的請求限制

連接頻率限制 -limit_conn_ module
請求頻率限制 -limit_req_ module

HTPP協議的請求與連接

HTTP1.0TCP不能複用
HTTP1.1順序性TCP複用
HTTP2.0多路複用TCP複用

HTTP請求建立在一次TCP連接基礎上
一次TCP請求至少產生一次HTTP請求
1.連接限制
Syntax:limit_conn_zone key zone=name:size;
Default:-
Context:http

Syntax:limit_conn zone number;
Default:-
Context:http,server,location

2.請求限制
Syntax:limit_req_zone key zone=name:size rate=rate;
Default:-
Context:http

Syntax:limit_req zone=name [burst=number] [nodelay];
Default:-
Context:http,server,location

limit_conn_zone $binary_remote_addr zone=conn_zone:1m;
limit_req_zone $binary_remtoe_addr zone=req_zone:1m rate=1r/s; #一個ip地址的客戶端1秒允許發送一個請求 1MB
server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /opt/app/code;
        index  index.html index.htm;
		#random_index on;
	#limit_conn conn_zone 1;
	#limit_req zone=req_zone burst=3 nodelay;
	#limit_req zone=req_zone burst=3;
	#limit_req zone=req_zone;
    }
	location /zjlstatus{
		stub_status;
	}	

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}


Nginx的訪問控制

基於IP的訪問控制 -http_access_module
允許
Syntax:allow address(IP地址) | CIDR(網段) |unix(scoket訪問)|all(所有);
Default:-
Context:http,server,location,limit_except

不允許
Syntax:deny address(IP地址) | CIDR(網段) |unix(scoket訪問)|all(所有);
Default:-
Context:http,server,location,limit_except

基於用戶的信任登錄 - http_auth_basic_module
default.conf
server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

 location / {
        root   /opt/app/code;
        #index  admin.html;
    }
	
location ~^/admin.html {
        root   /opt/app/code;
	deny   36.106.4.102;
	deny   36.106.4.103;
	deny   36.106.4.104;
	allow all;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}
nginx -t -c /etc/nginx/nginx.conf
nginx -s reload -c /etc/nginx/nginx.conf
http_access_module具有侷限性
http_x_forwarded_for

http_x_forwarder_for =Client IP, Proxy(1) IP ,Proxy(2) IP,...
如何解決侷限性?
方法一、採用別的HTTP頭信息控制訪問,如HTTP_X_FORWARD_FOR
方法二、結合geo模塊作
方法三、通過HTTP自定義變量傳遞

http_auth_basic_module  基於用戶的信任登錄

Syntax:auth_basic string(表示開啓,並在前端顯示這個字符串)|off;
Default:auth_basic off;
Context:http,server,location,limit_except

Syntax:auth_basic_user_file file(文件,文件的配置文件,用於存儲帳號密碼信息的);
Default:--
Context:http,server,location,limit_except

首先生成一個存用戶密碼的文件:
[root@VM_69_65_centos nginx]# htpasswd -c ./auth_conf jeson
New password: 
Re-type new password: 
Adding password for user jeson
生成的auth_conf文件中的內容:jeson:$apr1$XzHJd5JC$ueCc/zNNgHaU8FOQPgyee/
侷限性:
用戶信息依賴文件方式
操作管理機械,效率低下


3解決方案
Nginx結合LUA實現高校驗證
Nginx和LDAP打通,利用nginx-auth-ldap模塊

第三方模塊

暫不介紹。


發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章