Nginx日志中的双引号解析问题

这个问题其实是在上一篇的问题解决之后出现的又一个问题,还好测试到了,问题是这样的:

在Nginx记录的日志中会把出现在日志行中的双引号解析为x22

apache里面的正常日志应该是下面这样:

18.14.6.19 [28/Aug/2014:16:20:04 +0800] GET /server/shop/game/118 pos=0&cnt=50 200 \"clientInfo\":{\"num\":\"1375\",\"op\":\"46000\",\"dev\":\"GN708W\",\"imei\":\"862795012135838\",\"pkg\":\"com.assistor\",\"vc\":420,\"imsi\":\"460009182585103\",\"sdk\":17,\"vn\":\"4.2.0\",\"ccid\":\"5\"} 0.046

但是同样的log_format参数配置,到了Nginx里面就成了下面这样:

18.14.6.19 [28/Aug/2014:16:20:04 +0800] GET /server/shop/game/118 pos=0&cnt=50 200 \x22clientInfo\x22:{\x22num\x22:\x221375\x22,\x22op\x22:\x2246000\x22,\x22dev\x22:\x22GN708W\x22,\x22imei\x22:\x22862795012135838\x22,\x22pkg\x22:\x22com.assistor\x22,\x22vc\x22:420,\x22imsi\x22:\x22460009182585103\x22,\x22sdk\x22:17,\x22vn\x22:\x224.2.0\x22,\x22ccid\x22:\x225\x22} 0.046

查了很多资料,其中这里提到了,但是按照这办法没有测试成功,后来看到Nginx的Changelog里面是这样写的

Changes with nginx 1.1.6 17 Oct 2011

*) Change: now the 0x7F-0x1F characters are escaped as \xXX in an
   access_log.
Changes with nginx 0.7.0 19 May 2008

*) Change: now the 0x00-0x1F, '"' and '\' characters are escaped as \xXX
   in an access_log.
   Thanks to Maxim Dounin.

貌似Nginx是有意为之,只能理解为Nginx默认的log_format使用双引号作为间隔符,为了避免日志分析时候出现混乱,所以将双引号解析为x22了。

后来想了个笨办法,在每天日志切割的时候,替换日志中的x22字符为双引号,也算是绕过这个烦人的问题了。

附Nginx日志切割脚本

#!/bin/bash

#setting log path
log_files_path="/usr/local/nginx/logs/"
log_files_dir=${log_files_path}$(date -d "yesterday" +"%Y")/$(date -d "yesterday" +"%m")

#setting nginx
nginx_sbin="/usr/local/nginx/sbin/nginx"

if [ ! -d $log_files_dir ]; then
    mkdir -p $log_files_dir
fi

cd $log_files_path

#setting log name
log_files_name=(www.abc.com)
log_files_num=${#log_files_name[@]}

for((i=0;i<$log_files_num;i++));do
mv ${log_files_path}${log_files_name[i]}.log ${log_files_dir}/${log_files_name[i]}.log
/bin/sed -e 's/x22/"/g' ${log_files_dir}/${log_files_name[i]}.log > ${log_files_dir}/${log_files_name[i]}_$(date -d "yesterday" +"%Y%m%d").log
/bin/rm ${log_files_dir}/${log_files_name[i]}.log
done

kill -USR1 `cat /usr/local/nginx/nginx.pid`

 

 

发表评论

电子邮件地址不会被公开。 必填项已用*标注