NGINX requests per second

Question

I am developing an anti-application-level attack module for NGINX, and I have to count the request per second (every second). The idea is to make an automatic attack detector, which includes filtering when the query speed increases.

At this time, this happens with a shell script that reads the access log every second and calculates the request speed. The problem is that it is not very effective.

If you have an idea on how I can achieve this, share your thoughts.

Thanks!

Answer 1

You can use the HttpLimitReqModule:

http { limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s; ... server { ... location /search/ { limit_req zone=one burst=5; } 

link: http://wiki.nginx.org/HttpLimitReqModule

Answer 2

Use tail -f -s in access_log. It is quite effective.