Nginx 日志分析与性能调优：log_format 到 worker 调优

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for" '
                'rt=$request_time uct=$upstream_connect_time '
                'urt=$upstream_response_time';

http {
    log_format main '...';
    server {
        access_log /var/log/nginx/example.com.access.log main;
    }
}

log_format json_combined escape=json
    '{'
      '"time_local":"$time_local",'
      '"remote_addr":"$remote_addr",'
      '"request":"$request",'
      '"status":$status,'
      '"body_bytes_sent":$body_bytes_sent,'
      '"request_time":$request_time,'
      '"upstream_response_time":"$upstream_response_time",'
      '"http_user_agent":"$http_user_agent",'
      '"http_x_forwarded_for":"$http_x_forwarded_for",'
      '"cache_status":"$upstream_cache_status"'
    '}';

access_log /var/log/nginx/access.json json_combined;

# Filebeat 采集 JSON 日志 → Elasticsearch/Loki
filebeat.inputs:
  - type: log
    paths: [/var/log/nginx/access.json]
    json.keys_under_root: true

-- 以 ClickHouse 为例：查询慢接口与命中率
SELECT request,
       quantile(0.95)(request_time) AS p95,
       countIf(status >= 500) AS err_cnt,
       countIf(cache_status = 'HIT') AS hits,
       count() AS total
FROM nginx_access
WHERE time_local >= now() - INTERVAL 1 HOUR
GROUP BY request
ORDER BY p95 DESC
LIMIT 10;

# 状态码分布
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# 请求耗时 Top10
awk '{print $NF, $7}' /var/log/nginx/access.log \
  | sort -rn | head -10

# 5xx 高频接口
awk '$9>=500 {print $7}' /var/log/nginx/access.log \
  | sort | uniq -c | sort -rn | head

goaccess /var/log/nginx/access.log --log-format=COMBINED -o report.html

error_log /var/log/nginx/error.log warn;   # 生产常用 warn
# 排错时临时降到 debug，会有大量输出
error_log /var/log/nginx/error.log debug;

worker_processes auto;               # 通常等于 CPU 核数
worker_cpu_affinity auto;            # 绑定 CPU，减少迁移
worker_rlimit_nofile 65535;          # 文件描述符上限

events {
    worker_connections  4096;
    use                 epoll;
    multi_accept        on;
    accept_mutex        on;
}

server {
    keepalive_timeout  30;       # 客户端空闲连接保持
    keepalive_requests 1000;     # 单连接最多处理请求数
    keepalive_timeout 30s;       # 新版区分长短连接
}

upstream backend {
    server 10.0.0.11:8080;
    keepalive 32;                # 上游空闲连接池
}

sendfile on;                     # 内核态直接发送文件
tcp_nopush on;                   # 攒满包再发，配合 sendfile
tcp_nodelay on;                  # 小包即时发送，配合 keepalive
proxy_buffering on;              # 上游响应缓冲
client_body_buffer_size 128k;

# ab 压测
ab -n 100000 -c 100 http://example.com/api/user

# wrk 多线程压测
wrk -t 8 -c 400 -d 30s --latency http://example.com/

# 观察系统指标
vmstat 1

观察日志指标 → 定位瓶颈（CPU/连接/带宽/后端）
→ 针对性改参数 → 复测对比 → 记录基线