Traffic tab

Requests over time, your busiest domains and pages, the IPs hitting you, the pages that fail and the ones that are slow — read from nginx on this server. No Grafana, ELK, Athena or CloudWatch to set up, and the data never leaves the server.

The tab appears under Nginx once Traffic insights are installed and running.

Traffic analysis — every server from one page

Traffic analysis in the sidebar shows the same view without opening each server. The tabs at the top are your servers: a green dot means Traffic insights are set up, red means not. Set-up servers come first and the first one opens by default. Picking a server connects to it in the background.

On a red server, Configure opens it at Nginx → Traffic insights, where you press Install. Come back and it's green. If no server has a saved login yet, the page asks you to connect one in Servers first.

Turn it on

1. Open Nginx → Traffic insights.
2. Press Install. It takes under a minute.

Installing:

• adds a second access log to nginx, in JSON, at /var/log/nginx/devops-traffic/access.log. Your own logs keep working exactly as before. A site with access_log off logs to this file only.
• tests the change with nginx -t and reloads nginx gracefully — no dropped connections. If anything fails, every change is put back and nothing stays installed.
• runs a small service, devops-traffic, under its own user. It opens no port and has no network access; the panel asks it questions over your SSH connection.
• sends one test request through nginx to prove it all works.

Remove puts nginx's config back byte for byte and deletes the service and its data.

Needs root or passwordless sudo, nginx 1.11.8 or newer, and about 600 MB free under /var/log/nginx.

What you see

• Tiles — requests (and per second), server errors (5xx) and client errors (4xx) as a share of requests, response time p95, unique IPs and data sent, each compared with the period before.
• Requests over time, split into 2xx, 3xx, 4xx and 5xx. Drag across the chart to zoom into a moment.
• Response time — p50 (the median) and p95 (only 5% of requests were slower).
• Tables — domains, endpoints, server errors, slowest endpoints, client IPs, 404s, status codes, methods, user agents, referrers, upstreams (the app behind nginx) and bots.
• Requests — the matching requests, newest first. Click one for every field and the raw log line.

Endpoints group ids together: /orders/123 and /orders/456 count as /orders/:id.

Filter

Click any row in a table to show only that value, or the filter icon at its end to exclude it. Everything on the tab follows the filters. Combine them: domain is shop.example.com + status ≥ 500 + path starts with /api.

Live refreshes every 10 seconds while the tab is open. Zooming pauses it; the ✕ on the zoom chip goes back.

How far back it goes

Recent requests are kept in the server's memory — about 3% of its RAM, from 500,000 requests on a 1 GB server to 5 million on a large one. A quiet site's memory reaches back weeks; a very busy one's, a day or two. The top of the tab shows how far back the data goes.

The service rebuilds its memory from the log after a restart. The log rotates itself at 256 MB, keeping one older copy.

Your own log format

The service reads one JSON object per line and needs ts, host, ip, method, uri and status. Extra keys are ignored, so you can add fields. Lines without those keys are skipped and counted — the Nginx → Traffic insights card shows how many and why.