Python解析Nginx访问日志统计IP与流量

月亮慢半拍

发布时间：2026-10-13 | 6人浏览过

原创

本文介绍如何使用Python脚本解析Nginx访问日志，统计各IP的访问次数及总流量。通过逐行读取日志文件，利用字符串分割提取IP地址和流量数据，并借助字典结构累加统计结果，最终输出IP访问频次、流量总和及平均流量大小，适用于服务器日常运维与性能监控场景。

本文详细介绍一种使用Python获取Nginx服务器IP访问统计及流量信息的方法，供读者参考实践。

#!/usr/bin/python
#coding=utf8
log_file = "/usr/local/nginx/logs/access.log"
with open(log_file) as f:
  contexts = f.readlines()
# define ip dict###
ip = {}   # key为ip信息，value为ip数量（若重复则只增加数量）
flow = {}  # key为ip信息，value为流量总和
sum = 0
for line in contexts:
  # count row size of flow
  size = line.split()[9]
  # print ip
  ip_attr = line.split()[0]
  # count total size of flow
  sum = int(size) + sum
  if ip_attr in ip.keys():  # if ip repeated，如果ip重复就将ip数量加一，而流量继续叠加
  # count of ip plus 1
    ip[ip_attr] = ip[ip_attr] + 1
  # size of flow plus size
    flow[ip_attr] = flow[ip_attr] + int(size)
  else:
  # if ip not repeated
  # define initial values of count of ip and size of flow
    ip[ip_attr] = 1
    flow[ip_attr] = int(size)
print(ip)
print(flow)
print(sum/1024/1024)

假设当前存在Nginx生成的访问日志文件，格式如下所示：

[root@weblogic ~]# cat access.log 
192.168.223.1 - - [18/Jul/2017:10:21:25 +0800] "GET /favicon.ico HTTP/1.1" 192.168.223.136:8080 404 24 "http://192.168.223.136:8080/proxy_path/index.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
192.168.223.136 "192.168.223.1" - - [17/Jul/2017:17:06:44 +0800] "GET /index.html HTTP/1.0" "192.168.223.136" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" "192.168.223.1"
192.168.223.1 - - [18/Jul/2017:10:30:12 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:30:12 +0800] "GET /index.html HTTP/1.0" "192.168.223.137" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"
192.168.223.1 - - [18/Jul/2017:10:38:38 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:38:38 +0800] "GET /index.html HTTP/1.0" "192.168.223.136:80" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"
192.168.223.1 - - [18/Jul/2017:10:45:07 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:45:07 +0800] "GET /index.html HTTP/1.0" "192.168.223.136:80" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"
192.168.223.1 - - [18/Jul/2017:10:51:25 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:51:25 +0800] "GET /index.html HTTP/1.0" "192.168.223.136:80" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"

接下来演示如何利用Python对Nginx日志中的IP地址进行统计处理。

核心思路是逐行读取文件内容，对每一行执行strip()和split()操作以生成列表，该列表的第一个元素即为所需的IP地址信息。

初始化一个空字典，其中键（key）存储IP地址，值（value）记录该IP出现的次数。若遇到重复IP，则在原有基础上累增加值。

[root@weblogic ~]# cat nginx.py 
#!/usr/bin/python
#coding=utf8
log_file = "/root/access.log"
ip = {}
with open(log_file) as f:
  for i in f.readlines():
    print i.strip().split()[0]
    ip_attr = i.strip().split()[0] 
    if ip_attr in ip.keys():      # 如果ip存在于字典中，则将该ip的value也就是个数进行增加
      ip[ip_attr] = ip[ip_attr] + 1
    else:
      ip[ip_attr] = 1
print ip

运行上述逻辑后，可获得如下执行结果：

[root@weblogic ~]# python nginx.py 
192.168.223.1
192.168.223.136
192.168.223.1
192.168.223.136
192.168.223.1
192.168.223.136
192.168.223.1
192.168.223.136
192.168.223.1
192.168.223.136
{'192.168.223.1': 5, '192.168.223.136': 5}

如需了解更多Python相关技巧，可参考本站专题：《Python日志操作技巧总结》、《Python数据结构与算法教程》、《Python函数使用技巧总结》、《Python字符串操作技巧汇总》、《Python入门与进阶经典教程》及《Python文件与目录操作技巧汇总》。

希望本文提供的代码思路能对您的Python编程与服务器运维工作有所帮助。