79 lines
2.6 KiB
Markdown
79 lines
2.6 KiB
Markdown
# topip - simple terminal haproxy log analyzer
|
|
|
|
It's meant to give you a quick overview of your haproxy logs, like:
|
|
|
|
- What ips are making the most connections?
|
|
- What vhost consumes the most bandwidth?
|
|
- Which files are most downloaded?
|
|
- Is there any bot that abuses your webserver?
|
|
|
|
## Installation
|
|
|
|
### Binaries
|
|
|
|
topip has prebuilt binaries for Linux and macOS on amd64 and arm64.
|
|
|
|
You can install it easily by using these commands:
|
|
|
|
```bash
|
|
wget https://git.rznet.fr/tchivert/topip/releases/download/latest/topip-<os>-<arch> -O /usr/local/bin/topip
|
|
chmod +x /usr/local/bin/topip
|
|
```
|
|
|
|
Exemple for an amd64 linux machine:
|
|
|
|
```bash
|
|
wget https://git.rznet.fr/tchivert/topip/releases/download/latest/topip-linux-amd64 -O /usr/local/bin/topip
|
|
chmod +x /usr/local/bin/topip
|
|
```
|
|
|
|
### Debian-based distributions
|
|
|
|
You can install topip with a deb package from my repository:
|
|
|
|
```bash
|
|
sudo curl https://dl.rznet.fr/api/packages/tchivert/debian/repository.key -o /etc/apt/keyrings/rznet-tchivert.asc
|
|
echo "deb [signed-by=/etc/apt/keyrings/rznet-tchivert.asc] https://dl.rznet.fr/api/packages/tchivert/debian stable main" | sudo tee -a /etc/apt/sources.list.d/rznet.list
|
|
sudo apt update
|
|
|
|
sudo apt install topip
|
|
```
|
|
|
|
Or by downloading directly the latest .deb:
|
|
|
|
```bash
|
|
wget https://git.rznet.fr/tchivert/topip/releases/download/latest/topip-amd64.deb
|
|
sudo dpkg -i topip_1.2-1_amd64.deb
|
|
```
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
Usage: topip [-f logfile] [-t conn|bytes] [-n num] [-p pattern] [-i all|ip|vhost|request] [-d]
|
|
-d Enable debug mode
|
|
-f string
|
|
Path to the HAProxy log file (use - for stdin) (default "/var/log/haproxy/haproxy.log")
|
|
-i string
|
|
Information to display (all, ip, vhost, req) (default "all")
|
|
-n int
|
|
Number of IP addresses and vhosts to display (default 20)
|
|
-p string
|
|
Filter by request pattern
|
|
-t string
|
|
Sort by connections or bytes sent (conn or bytes) (default "conn")
|
|
|
|
Recommended haproxy log-format:
|
|
log-format "%ci %b/%s %ST %B %Tt %sq/%bq %{+Q}r %hr %hs"
|
|
```
|
|
|
|
## topgeoip
|
|
|
|
In addition, [topgeoip](https://git.rznet.fr/tchivert/topip/src/branch/main/geo) can be used to quickly get basic geo information about the top IPs (country, asn and hit count of top ips).
|
|
|
|
It's simple and doesn't need a particular log format, you just need up to date maxmind geoip databases (see [geoipupdate](https://github.com/maxmind/geoipupdate)) to produce the geo information.
|
|
Otherwise it will just show the hit count of top ips.
|
|
|
|
## License
|
|
|
|
This project is licensed under the MIT License. See the [LICENSE](https://git.rznet.fr/tchivert/topip/src/branch/main/LICENSE) file for more information.
|