This topic describes the query statements that are used to configure monitoring and alerting for common metrics based on Log Service for WAF.
You can use Log Service for WAF to monitor the following metrics:
Note You can click a metric to view the involved query statement. For more information
about the metrics, see Common monitoring metrics.
request_time_msec
The duration between the time when the client sends a request and the time when the client receives a response to the request.
* |
SELECT
user_id,
host,
round(
round(request_time_cnt * 1.0000 / countall, 4) * 100,
2
) AS percent
FROM (
SELECT
user_id,
host,
count_if(request_time_msec > 500) AS request_time_cnt,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
GROUP BY
user_id,
host,
percentupstream_response_time
The duration between the time when WAF forwards a request to an origin server and the time when WAF receives a response to the request.
* |
SELECT
user_id,
host,
round(
round(
upstream_response_time_cnt * 1.0000 / countall,
4
) * 100,
2
) AS percent
FROM (
SELECT
user_id,
host,
count_if(upstream_response_time > 500) AS upstream_response_time_cnt,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
GROUP BY
user_id,
host,
percentstatus:200
The server has processed the request and returned the requested data.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:302 or 200 and final_plugin:'cc'
JavaScript CAPTCHA validation is triggered.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(
status = 200
AND final_plugin = 'cc'
) AS status_200,
count_if(
status = 302
AND final_plugin = 'cc'
) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) as status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:200 and final_plugin:'antifraud'
The request is blocked by data risk control rules.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(
status = 200
AND final_plugin = 'antifraud'
) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:404
The server failed to find the requested resources.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_404 DESC
LIMIT
5status:405 and waf_action:'block'
The request is blocked by the Protection Rules Engine.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(
status = 405
and waf_action = 'block'
) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_405 DESC
LIMIT
5status:405 and final_plugin:'acl'
The request is blocked by the blacklist or custom protection rules (ACLs).
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(
status = 405
and final_plugin = 'acl'
) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_405 DESC
LIMIT
5status:444
The request is blocked by HTTP flood protection rules.
* |
select
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_444 DESC
LIMIT
5status:499
The requested data is not returned because the server connection timed out and the client closed the connection. The server returns the 499 status code to the client.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_499 DESC
LIMIT
5status:500
The server failed to process the request because an internal error occurred on the server.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_500 DESC
LIMIT
5status:502
The WAF instance is used as a gateway or a proxy and receives an invalid response from the origin server. The origin server does not respond because the back-to-origin network is unstable or the back-to-origin request is blocked based on access control policies that are configured for the origin server.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_502 DESC
LIMIT
5status:503
The service is unavailable because the server is overloaded or being maintained.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 as "Percentage of 200 status code",
Rate_302 as "Percentage of 302 status code",
Rate_404 as "Percentage of 404 status code",
Rate_405 as "Percentage of 405 status code",
Rate_444 as "Percentage of 444 status code",
Rate_499 as "Percentage of 499 status code",
Rate_500 as "Percentage of 500 status code",
Rate_502 as "Percentage of 502 status code",
Rate_503 as "Percentage of 503 status code",
Rate_504 as "Percentage of 504 status code",
countall / 60 as "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) as Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) as Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) as Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) as Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) as Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) as Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) as Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) as Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) as Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) as Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) as status_200,
count_if(status = 302) as status_302,
count_if(status = 404) as status_404,
count_if(status = 405) as status_405,
count_if(status = 444) as status_444,
count_if(status = 499) as status_499,
count_if(status = 500) as status_500,
count_if(status = 502) as status_502,
count_if(status = 503) as status_503,
count_if(status = 504) as status_504,
COUNT(*) as countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_503 DESC
LIMIT
5status:504
The origin server is used as a gateway or a proxy and cannot receive the request from the upstream server in time.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_504 DESC
LIMIT
5