ここでは、WAF 内で Log Service を使用してモニタリングメトリックをクエリおよび分析するために使用される SQL 文について説明します。

次のリストは、ログサービスのログのクエリと分析に一般的に使用される指標について説明しています。 メトリックをクリックして、対応する SQL 文を表示できます。 パラメーターについての詳細は、「一般的な監視メトリック」をご参照ください。

request_time_msec

クライアントがリクエストを送信してからクライアントがレスポンスを受信するまでの時間。

* |SELECT user_id,host,round(round(request_time_cnt*1.0000/countall,4)*100,2)
as percent FROM (select user_id,host,count_if(request_time_msec>500)
AS request_time_cnt,COUNT(*) as countall from log group by user_id,host)
group by user_id,host,percent

upstream_response_time

WAF がデータをオリジンサーバーに送信してから、WAF がオリジンサーバーからレスポンスを受信するまでの時間。

* |SELECT
user_id,host,round(round(upstream_response_time_cnt*1.0000/countall,4)*100,2)
as percent FROM (select
user_id,host,count_if(upstream_response_time>500) AS
upstream_response_time_cnt,COUNT(*) as countall from log group by
user_id,host) group by user_id,host,percent

ssl_handshake_time

HTTPS リクエスト中のクライアントと WAF との間の SSL ハンドシェイクに必要な時間。

* |SELECT
user_id,host,round(round(ssl_handshake_time_cnt*1.0000/countall,4)*100,2) as
percent FROM (select user_id,host,count_if(ssl_handshake_time>10) AS
ssl_handshake_time_cnt,COUNT(*) as countall from log group by
user_id,host) group by user_id,host,percent

200

サーバーはリクエストを処理し、リクエストされたデータを返しました。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as Rate_502,round(round(status_503*1.0000/countall,4)*100,2)
as Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as status_500,count_if(status=502)
as status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*) as countall from log group by user_id,host))
where countall>120 order by Rate_200 DESC limit 5

status:302 and block_action:tmd/status:200 and block_action:tmd

ステータスコードは、CAPTCHA がトリガーされているかどうかを示します。 コード 302 は CAPTCHA がトリガーされることを示します。コード 200 は CAPTCHA がトリガーされないことを示し、ユーザーは HTTP フラッド保護をカスタマイズする必要があります。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as Rate_444,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as Rate_503,round(round(status_504*1.0000/countall,4)*100,2)
as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200 and 

block_action:tmd

) as status_200,count_if(status=302 and 

block_action:tmd

) as
status_302,count_if(status=404) as status_404,count_if(status=405) as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*) as countall from log group by user_id,host))
where countall>120 order by Rate_200 DESC limit 5

200 and block_action:‘antifraud’

リクエストは、データリスク管理によってブロックされます。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302, round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200 and block_action:‘antifraud’) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*) as countall from
log group by user_id,host)) where countall>120 order by Rate_200
DESC limit 5

status:404

サーバーは、リクエストされたリソースを見つけられませんでした。

*|select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_500 as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503
as "Status code 503 percentage",Rate_504 as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_405,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*)  as countall from log group by user_id,host))
where countall>120 order by Rate_404 DESC limit 5

status:405 and aliwaf_action='block'

リクエストは、Webアプリケーション保護ルールによってブロックされます。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as "aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405 and aliwaf_action='block') as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as status_504,COUNT(*) 
as countall from log group by user_id,host)) where countall>120 order
by Rate_405 DESC limit 5

status:405 and aliwaf_action='acl'

リクエストは HTTP ACL ポリシールールによってブロックされます。

user_id: 1111111111111 |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as Rate_500,round(round(status_502*1.0000/countall,4)*100,2)
as Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405 and aliwaf_action='acl') as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*) as countall from log group by user_id,host)) where 
countall>120 order by Rate_405 DESC limit 5

status:444

リクエストは、カスタム HTTP フラッド保護ルールによってブロックされます。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as Rate_503,round(round(status_504*1.0000/countall,4)*100,2)
as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as status_200,count_if(status=302)
as status_302,count_if(status=404) as status_404,count_if(status=405) as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*) as countall from log group by user_id,host))
where countall>120 order by Rate_444 DESC limit 5

status:499

クライアントがリクエストを送信した後、サーバーがデータを返しません。 クライアントの最大待機時間に達すると、クライアントは切断され、サーバーはこのステータスコードを返します。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*) as countall from
log group by user_id,host)) where countall>120 order by Rate_499
DESC limit 5

status:500

500 Internal Server Error のため、リクエストを処理できません。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*) as countall from
log group by user_id,host)) where countall>120 order by Rate_200
DESC limit 5

status:502

サーバーはゲートウェイまたはプロキシとして使用され、502 Bad Gateway エラーが原因で上流サーバーから無効なレスポンスを受信します。 オリジンサーバーは、back-to-origin ネットワークのパフォーマンスが低いか、back-to-origin リクエストがオリジンサーバーに設定されたアクセス制御ポリシーによってブロックされているため、応答しません。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as Rate_502,round(round(status_503*1.0000/countall,4)*100,2)
as Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as status_500,count_if(status=502)
as status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*) as countall from log group by user_id,host))
where countall>120 order by Rate_502 DESC limit 5

status:503

過負荷またはメンテナンスが必要なため、サービスは利用できません。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as status_404,count_if(status=405)
as status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as status_504,COUNT(*) 
as countall from log group by user_id,host)) where countall>120 order
by Rate_503 DESC limit 5

status:504

サーバーはゲートウェイまたはプロキシとして機能し、上流のサーバーからのリクエストを時間内に受信できません。 504 Gateway Timeout エラーが発生しました。

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*) as countall from
log group by user_id,host)) where countall>120 order by Rate_504 DESC 
limit 5