WAF常用的日誌查詢與分析語句 - Web Application Firewall

本文介紹了使用WAFLog Service配置常用業務指標監控及警示時，用到的日誌查詢與分析語句。

您可以使用WAFLog Service監控以下業務指標：

說明

單擊某個指標，查看對應的日誌查詢與分析語句。關於監控指標的更多資訊，請參見常用監控指標。

request_time_msec
upstream_response_time
status:200
status:302 or 200 and final_plugin:'cc'
status:200 and final_plugin:'antifraud'
status:404
status:405 and waf_action:'block'
status:405 and final_plugin:'acl'
status:444
status:499
status:500
status:502
status:503
status:504

request_time_msec

指標釋義：表示用戶端從發起請求到獲得返回結果的請求耗時。

* |
SELECT
  user_id,
  host,
  round(
    round(request_time_cnt * 1.0000 / countall, 4) * 100,
    2
  ) AS percent
FROM  (
    SELECT
      user_id,
      host,
      count_if(request_time_msec > 500) AS request_time_cnt,
      COUNT(*) AS countall
    FROM      log
    GROUP BY
      user_id,
      host
  )
GROUP BY
  user_id,
  host,
  percent

upstream_response_time

指標釋義：表示WAF轉寄用戶端請求到來源站點伺服器，來源站點返回資料的回應時間。

* |
SELECT
  user_id,
  host,
  round(
    round(
      upstream_response_time_cnt * 1.0000 / countall,
      4
    ) * 100,
    2
  ) AS percent
FROM  (
    SELECT
      user_id,
      host,
      count_if(upstream_response_time > 500) AS upstream_response_time_cnt,
      COUNT(*) AS countall
    FROM      log
    GROUP BY
      user_id,
      host
  )
GROUP BY
  user_id,
  host,
  percent

status:200

指標釋義：表示伺服器已成功處理請求，返回了被請求的資料。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM  (
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_200 DESC
LIMIT
  5

status:302 or 200 and final_plugin:'cc'

指標釋義：表示請求觸發了WAF的JavaScript人機校正策略。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM  (
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(
            status = 200
            AND final_plugin = 'cc'
          ) AS status_200,
          count_if(
            status = 302
            AND final_plugin = 'cc'
          ) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) as status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_200 DESC
LIMIT
  5

status:200 and final_plugin:'antifraud'

指標釋義：表示請求被WAF的Alibaba Antifraud Service規則攔截。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM  (
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(
            status = 200
            AND final_plugin = 'antifraud'
          ) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_200 DESC
LIMIT
  5

status:404

指標釋義：表示伺服器找不到被請求的資源。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM  (
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_404 DESC
LIMIT
  5

status:405 and waf_action:'block'

指標釋義：表示請求被WAF的規則防護引擎攔截。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(
            status = 405
            and waf_action = 'block'
          ) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_405 DESC
LIMIT
  5

status:405 and final_plugin:'acl'

指標釋義：表示請求被WAF的黑名單及自訂防護策略（ACL存取控制）規則攔截。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(
            status = 405
            and final_plugin = 'acl'
          ) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_405 DESC
LIMIT
  5

status:444

指標釋義：表示請求被WAF的CC安全防護規則攔截。

* |
select
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_444 DESC
LIMIT
  5

status:499

指標釋義：表示伺服器逾時未返回用戶端請求的資料，用戶端主動斷鏈。伺服器返回給用戶端499狀態代碼。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_499 DESC
LIMIT
  5

status:500

指標釋義：伺服器內部錯誤（Internal Server Error），表示伺服器無法完成請求。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_500 DESC
LIMIT
  5

status:502

指標釋義：錯誤網關（Bad Gateway），表示伺服器作為網關或代理，從上遊伺服器收到無效響應。一般由於回源網路品質變差、回源鏈路有存取控制策略攔截回源請求等，導致來源站點無響應。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_502 DESC
LIMIT
  5

status:503

指標釋義：服務不可用（Service Unavailable），表示由於超載或停機維護，伺服器目前無法使用。

* |
SELECT
  user_id,
  host as "網域名稱",
  Rate_200 as "200比例",
  Rate_302 as "302比例",
  Rate_404 as "404比例",
  Rate_405 as "405比例",
  Rate_444 as "444比例",
  Rate_499 as "499比例",
  Rate_500 as "500比例",
  Rate_502 as "502比例",
  Rate_503 as "503比例",
  Rate_504 as "504比例",
  countall / 60 as "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) as Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) as status_200,
          count_if(status = 302) as status_302,
          count_if(status = 404) as status_404,
          count_if(status = 405) as status_405,
          count_if(status = 444) as status_444,
          count_if(status = 499) as status_499,
          count_if(status = 500) as status_500,
          count_if(status = 502) as status_502,
          count_if(status = 503) as status_503,
          count_if(status = 504) as status_504,
          COUNT(*) as countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_503 DESC
LIMIT
  5

status:504

指標釋義：網關逾時（Gateway Timeout），表示伺服器作為網關或代理，沒有及時從上遊伺服器收到請求。

* |
SELECT
  user_id,
  host AS "網域名稱",
  Rate_200 AS "200比例",
  Rate_302 AS "302比例",
  Rate_404 AS "404比例",
  Rate_405 AS "405比例",
  Rate_444 AS "444比例",
  Rate_499 AS "499比例",
  Rate_500 AS "500比例",
  Rate_502 AS "502比例",
  Rate_503 AS "503比例",
  Rate_504 AS "504比例",
  countall / 60 AS "aveQPS",
  status_200,
  status_302,
  status_404,
  status_405,
  status_444,
  status_499,
  status_500,
  status_502,
  status_503,
  status_504,
  countall
FROM(
    SELECT
      user_id,
      host,
      round(
        round(status_200 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_200,
      round(
        round(status_302 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_302,
      round(
        round (status_404 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_404,
      round(
        round (status_405 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_405,
      round(
        round (status_444 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_444,
      round(
        round (status_499 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_499,
      round(
        round(status_500 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_500,
      round(
        round(status_502 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_502,
      round(
        round(status_503 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_503,
      round(
        round(status_504 * 1.0000 / countall, 4) * 100,
        2
      ) AS Rate_504,
      status_200,
      status_302,
      status_404,
      status_405,
      status_444,
      status_499,
      status_500,
      status_502,
      status_503,
      status_504,
      countall
    FROM      (
        SELECT
          user_id,
          host,
          count_if(status = 200) AS status_200,
          count_if(status = 302) AS status_302,
          count_if(status = 404) AS status_404,
          count_if(status = 405) AS status_405,
          count_if(status = 444) AS status_444,
          count_if(status = 499) AS status_499,
          count_if(status = 500) AS status_500,
          count_if(status = 502) AS status_502,
          count_if(status = 503) AS status_503,
          count_if(status = 504) AS status_504,
          COUNT(*) AS countall
        FROM          log
        GROUP BY
          user_id,
          host
      )
  )
WHERE
  countall > 120
ORDER BY
  Rate_504 DESC
LIMIT
  5