ITトレンド等をまとめるブログ

各種logの確認方法

目次

ログの場所

アプリケーションログの場所設定値参考サイト
Apache/var/log/httpd/access_log
※以下の場合もあるらしい
/var/log/apache2/access.log		/etc/httpd/conf/httpd.confhttps://beyondjapan.com/blog/2020/02/access-log/
Nginx/var/log/nginx/access.log/etc/nginx/nginx.confhttps://beyondjapan.com/blog/2024/02/nginx-access-log/
bind/var/named/log/transfer.log

コマンド

Apacheのコンフィグ確認(cat /etc/httpd/conf/httpd.conf)

    # (Combined Logfile Format) you can use the following directive.
    #
    CustomLog "logs/access_log" combined
</IfModule>

テキストを表示するコマンド(tail /var/log/httpd/access_log)

[root@ip-10-6-0-30 ~]# tail /var/log/httpd/access_log 
10.6.0.248 - - [10/Sep/2024:14:20:35 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.10.247 - - [10/Sep/2024:14:20:50 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.0.248 - - [10/Sep/2024:14:21:05 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.10.247 - - [10/Sep/2024:14:21:20 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.0.248 - - [10/Sep/2024:14:21:35 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.10.247 - - [10/Sep/2024:14:21:50 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.0.248 - - [10/Sep/2024:14:21:59 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 98 "https://www.jptrendhub.com/wp-admin/post.php?post=94&action=edit" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
10.6.0.248 - - [10/Sep/2024:14:22:05 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.10.247 - - [10/Sep/2024:14:22:20 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
10.6.0.248 - - [10/Sep/2024:14:22:35 +0000] "GET / HTTP/1.1" 301 - "-" "ELB-HealthChecker/2.0"
[root@ip-10-6-0-30 ~]#

調査

大量のリクエストがあるIPアドレスを特定する

awk '{print $1}' /var/log/httpd/access_log | sort | uniq -c | sort -nr | head -n 10

異常なHTTPステータスコードを探す

awk '{print $9}' /var/log/httpd/access_log | sort | uniq -c | sort -nr | head -n 10

エラーログに関連するリクエストを探す

grep "404" /var/log/httpd/error_log

PAGE TOP