Real-time Nginx monitoring

Ngxtop is a powerful command-line tool that parses your Nginx access logs and displays them in a real-time interface, similar to the classic top utility.

It provides an instant overview of your server's load, highlighting top requests, visitor IP addresses, HTTP status codes, and other vital metrics—eliminating the need to manually parse dense log files during troubleshooting.

Installing ngxtop

The easiest way to install ngxtop is via pip:

pip install ngxtop

Basic commands

ngxtop [options]
ngxtop [options] (print | top | avg | sum)

To see a comprehensive list of available flags and filters, run:

ngxtop --help

By default, ngxtop automatically detects your access log location from the Nginx configuration file (/etc/nginx/nginx.conf). If multiple logs are found, the utility will prompt you to select the one you wish to monitor:

Multiple access logs detected in configuration:
1. /var/log/nginx/access502.log
2. /var/log/nginx/access.api.log
3. /var/log/nginx/access.img.log
4. /var/log/nginx/access.log
5. /var/log/nginx/access404.log

Practical examples

1. Monitoring 404 errors
   Isolate "Not Found" errors to identify broken links or scanning attempts:

ngxtop -i 'status == 404' print request status

Example output:

running for 130 seconds, 150 records processed: 1.15 req/sec

request, status:
| request                                      | status |
|----------------------------------------------|--------|
| GET /browserconfig.xml HTTP/1.1              | 404    |
| GET /employer/my/archive/2107569/98483600/   | 404    |
| GET /jobs/1045534/ HTTP/1.1                  | 404    |

2. Top IP addresses by request count
   Identify the most active visitors or potential DDoS sources:

ngxtop top remote_addr

Example output:

running for 8 seconds, 1759 records processed: 217.15 req/sec

top remote_addr
| remote_addr     | count |
|-----------------|-------|
| 92.60.184.91    | 45    |
| 66.249.78.10    | 42    |
| 77.120.121.122  | 42    |

Key takeaways

• Instant analysis: ngxtop is perfect for "on-the-fly" server health checks and identifying traffic spikes.
• Troubleshooting: use it to quickly pin down the source of 500-series errors or suspicious request patterns.
• Scaling your monitoring: while ngxtop is excellent for immediate terminal-based observation, consider long-term solutions like Prometheus + Grafana or Zabbix for historical data and advanced alerting.