README

Nginx Virtual Host traffic monitoring munin plugin

You need to log all the Virtual Hosts in the same access file

Filtering and accounting is done by logtail and awk so it has to be efficient
with large logfiles and busy sites.

------------
INSTALLATION
------------

Install logtail
http://www.logcheck.org/download.html
(Avaliable in most distributions)

Add the following lines in your nginx.conf

log_format main '"$remote_addr" $host [$time_local] '
                '"$request" $status $body_bytes_sent '
                '$request_length $bytes_sent "$http_referer" '
                '"$http_user_agent" $request_time "$gzip_ratio"';
access_log /var/log/nginx/access.log main;


Configure in your munin-node config file:

/etc/munin/plugin-conf.d/munin-conf in Debian

[nginx_vhost_traffic]
group adm	#Set a group with read access to the access log

# List the virtual hosts to monitor
env.vhosts example.com example.net example.edu

# Define the path to the access log
env.logdir /var/log/nginx
env.flogfile access.log

# Aggregate subdomains
# ex: example.com will match www.example.com, webmail.example.com *.example.com
env.aggregate true #change to false to disable aggregation


Restart munin-host:
on debian:
/etc/init.d/munin-node restart


Wait 5 minutes for graphs

nginx_vhost_traffic

#!/bin/sh

LOGDIR=${logdir:-/var/log/nginx}
ACCESS_LOG=$LOGDIR/${logfile:-access.log}
LOGTAIL=${logtail:-`which logtail`}
STATEFILE=/var/lib/munin/plugin-state/nginx_vhost_traffic.state
VHOSTS=${vhosts:-`hostname`}
AGGREGATE=${aggregate:-true}

BPARAM=${bparam:-11}

case $1 in
   config)
        DRAW=AREA
        echo 'graph_title Nginx Virtual host traffic'
        echo 'graph_vlabel bits out / ${graph_period}'
        echo 'graph_args --base 1000 -l 0'
        echo 'graph_category Nginx'

        i=0
        for vhost in $VHOSTS 
        do 
                i=$(($i + 1))
                echo vhost$i.label $vhost
                echo vhost$i.type ABSOLUTE
                echo vhost$i.cdef vhost$i,8,*
                echo vhost$i.draw $DRAW
                DRAW=STACK
        done

        echo rest.label Rest
        echo rest.type ABSOLUTE
        echo rest.cdef rest,8,*
        echo rest.draw STACK
    exit 0;;
esac

export BPARAM
export VHOSTS
export AGGREGATE

# Awk Script
$LOGTAIL -f ${ACCESS_LOG} -o $STATEFILE | awk '

BEGIN { 
split(ENVIRON["VHOSTS"], hosts)
for (host in hosts) { track[hosts[host]] = host}
}        
{
                cn[$2]+=$ENVIRON["BPARAM"]
}
END { 
                for (host in cn) {
                if (match(ENVIRON["AGGREGATE"], "true")) {
                        found = 0
                        for (vhost in track) {
                                if (index(host, vhost)) {
                                res[vhost] += cn[host]
                                found = 1
                                break
                                }
                        }
                        if (! found) rest+=cn[host]
                } else {
                        if (host in track) {
                                res[host] += cn[host]
                        } else rest+=cn[host]
                }
                }
                print "agregate: " ENVIRON["AGGREGATE"]
                for (vhost in track) print "vhost" track[vhost] ".value " res[vhost]+0
                print "rest.value " rest + 0
}'