Website traffic, number of connections and other monitoring

One, Nginx view concurrent connection

1. Viewing through the Web interface,

① Open the Status module, that is, when installing Nginx plus--with-http_stub_status_module

② Modify nginx.conf, add the following to the server section

Location/nginxstatus {   stub_status on;   Access_log/usr/local/nginx/logs/status.log;    #日志   auth_basic "Nginxstatus";            } #access_log, Auth_basic can not write

③ re-load the Nginx service and then access HTTP.//your domain through the browser/nginxstatus

Status Description:

Active connections//current Nginx is processing the number of live connections.

The server accepts handledrequests//processed a total of 387,142 connections, successfully creating 387,142 handshakes, and processed a total of 4,804,888 requests.

Reading//nginx The number of Header messages read to the client.

Writing//nginx Returns the number of Header information returned to the client.

Waiting//Open keep-alive, this value equals active-(reading+writing), meaning that Nginx has finished processing the host connection that is waiting for the next request instruction.

2. By

[Email protected] ~]# netstat [-a] [-b] [-e] [-f] [-n] [-O] [-P proto] [-r] [-S] [-t] [interval]

Status Description:

Last_ack//wait for all packets to die

SYN_RECV//A connection request has arrived, waiting for confirmation

Established//Normal data transfer status/current number of concurrent connections

Fin_wait2//The other side has agreed to release

itmed_wait//wait for all packets to die

CLOSING//Both sides try to close simultaneously

Time_wait//The other side has initialized a release

Reference: https://www.cnblogs.com/lianzhilei/p/6025267.html

Second, netstat view the number of connections, number of concurrent

[Email protected] ~]# Netstat-n | awk '/^tcp/{++s[$NF]} END {for (a in S) print A,s[a]} '

Status Description:

-a displays all connections and listening ports. Common
-B Displays the executable program involved in creating each connection or listening port. Common
In some cases, it is known that the executable program hosts multiple Independent
component, which in these cases shows when a connection or listening port is created
and a sequence of components. In this case, the name of the executable program
At the bottom [], the component it calls is located at the top, up to
to TCP/IP. Note that this option can be time-consuming and
May fail if sufficient permissions are available.
-e Displays Ethernet statistics. This option can be used in conjunction with the-s option. Common
-F Displays the fully qualified domain name (FQDN) of the external address. Useless
-N Displays the address and port number in digital form. Common
-O Displays the ID of the process that you have associated with each connection. Useless
-p proto shows the connection of proto specified protocol; Proto can be any of the following
What: TCP, UDP, TCPv6, or UDPV6.
If used with the-s option to display statistics for each protocol, Proto can be any of the following
What: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP
or UDPV6.
-r Displays the routing table. Common
-S displays statistics for each protocol. By default, display//useful
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPV6
The-p option can be used to specify a default subnet.
-T displays the current connection offload status. Useless

Interval re-displays the selected statistics, the number of seconds between each display pause.
Press CTRL + C to stop displaying the statistics again. If omitted, the Netstat
The current configuration information is printed once.

Third, netstat real-time monitoring IP connection number

If the server is being attacked by traffic, or other scenarios that need to see the number of IP connections, you can use the following command to monitor the number of connections for each IP in real time.

[Email protected] ~]# Netstat-ntu | awk ' {print $} ' | Cut-d:-f1 | Sort | uniq-c | Sort-n

Iv. Iftop Flow Monitoring

1, Iftop interface related instructions

The interface above shows a scale range similar to that of the scale, which is used as a ruler for the bar showing the flow graph.

The <= in the middle and the two left and right arrows indicate the direction of the flow.

TX: Send Traffic
RX: Receive Traffic
Total: Overall flow
Cumm: Total traffic running iftop to current time
Peak: Traffic Peaks
Rates: Represents the average traffic for the past 2s 10s 40s, respectively

2, Iftop related parameters

Common parameters

-I set the monitoring network card, such as: # Iftop-i eth1

-B displays traffic in bytes (default is bits), such as: # Iftop-b

-N Causes the host information to display IP directly by default, such as: # Iftop-n

-N causes port information to be displayed by default directly, such as: # Iftop-n

-F shows incoming and outgoing traffic for a specific segment, such as # iftop-f 10.10.1.0/24 or # iftop-f 10.10.1.0/255.255.255.0

-H (Display this message), Help, display parameter information

-p after using this parameter, the middle list shows the local host information, and the IP information outside of this machine appears;

-B to display the flow graph bar by default;

-F This is not very likely to use, filter the calculation of the packet;

-P enables host information and port information to be displayed by default;

-M sets the maximum value of the top-most scale of the interface, with a scale of five large segments, for example: # iftop-m 100M

Some operation commands after entering the Iftop screen (note case)

Press H to toggle whether help is displayed;

Press N to toggle the display of the IP or host name of the machine;

Press S to toggle whether the host information of the machine is displayed;

Press D to toggle whether the host information of the remote target hosts is displayed;

Press T to toggle the display format to 2 lines/1 lines/Only send traffic/show receive traffic only;

Press N to toggle display port number or port service name;

Press S to toggle whether to display the port information of the machine;

Press D to toggle whether the port information of the remote target host is displayed;

Press p to toggle whether the port information is displayed;

Press p to toggle pause/resume display;

Press B to toggle whether the average flow graph bar is displayed;

The average flow in 2 seconds or 10 seconds or 40 seconds is calculated by B switch;

Press T to toggle whether the total traffic for each connection is displayed;

Press L to turn on the screen filtering function, enter the characters to filter, such as IP, press ENTER, the screen will only show this IP-related traffic information;

Press L to toggle the scale on the top of the display screen, and the flow graph bar will change depending on the scale;

Press J or press K to scroll up or down the screen to display the connection record;

Press 1 or 2 or 3 to sort by the three-column traffic data displayed on the right;

Sort by < According to the native name or IP on the left;

Sort by > According to the host name or IP of the remote target host;

Press O to toggle whether the current connection is fixed only;

Press F to edit the filter code, this is translated by the saying, I have not used this!

You can use the shell command, this is useless! I don't know what the order is.

Press Q to exit the monitor.

Reference: https://www.vpser.net/manage/iftop.html

Website traffic, number of connections and other monitoring