Quick statistics of the distribution of HTTP requests

Quick statistics of the distribution of HTTP requestsNemozhang 2012-09-22 09:56BHMVDGYE3KCAW+BUS4NVW Requirements:
There are a bunch of CGI, you need to pass in the AppID parameter, how to see the current number of those AppID maximum?
How do I view the request volume distributions for these CGI?

Solution:
Assuming that our webserver request is through the LVS access, then all the external network requests are through the TUNL0 network card, assuming that the native bound LVs IP is: 113.108.20.23, the listening port is 80, then the statistical script is:

To count all requests sent to this machine, the distribution of AppID
sudo tcpdump-c 30000-itunl0-s, DST Port, and DST host 113.108.20.23-a 2>&1 | Awk-f ' appid= ' {print $} ' |tee/tmp/tee.log| Awk-f ' & ' {print $} ' |awk-f ' {print $} ' | Sort | uniq-c | Sort-rn | Head
120298//This line is a blank line and can be ignored
1349//AppID 47 hits 1349 Times
447 61
421 2141
370 2736
253 2227
192 33
145 282
139 121282
125 343

To count all requests sent to this machine, the CGI distribution
sudo tcpdump-c 30000-itunl0-s, DST Port, and DST host 113.108.20.23-a 2>&1 | grep ' get\| POST ' | Awk-f ' {print $ (NF-1)} ' | Awk-f '? ' ' {print $} ' |grep-v ' \. ' | Sort | uniq-c | Sort-rn | Head
1150/v3/user/get_info
1011/v3/user/is_login
991/v3/spread/is_reminder_set
635/v3/spread/set_reminder
240/v3/page/is_fans
210/v3/relation/get_app_friends
140/v3/user/is_setup
126/v3/user/is_vip
97/v3/user/get_multi_info
76/v3/user/total_vip_info

Analysis:
-c 30000 means to pull out of 30,000 packets.
-S 512 shows the first 512 bytes of each package. -S 0 is show all, too much not much not necessary.
-a displays the package in ASCII mode.
Tee The command is a bidirectional redirection command that allows you to easily view the intermediate output of the pipeline.

Extended:
You can count the distribution of any parameter in an HTTP request, simply change the AppID to PF, and you can count the distribution of requests from each platform.