ngxtop
ngxtop is a Python CLI tool that provides real-time, top-like monitoring of nginx (and Apache/Caddy) access logs. It parses log files on-the-fly to show request counts, HTTP status distributions, response sizes, and custom aggregations without storing data externally.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | lebinh/ngxtop |
| Owner | lebinh |
| Primary language | Python |
| License | MIT — OSI-approved |
| Stars | 6.5k |
| Forks | 475 |
| Open issues | 62 |
| Latest release | Unknown |
| Last updated | 2026-03-02 |
| Source | https://github.com/lebinh/ngxtop |
What ngxtop is
ngxtop streams log entries, applies optional filters, groups by configurable variables (request path, IP, etc.), and computes aggregations (sum, avg, min, max, count) over a rolling interval. It supports multiple log formats (nginx combined/common, Apache common, Caddy JSON) and can parse remote logs via stdin, making it suitable for ad-hoc diagnostics rather than persistent monitoring.
Get the ngxtop source
Clone the repository and explore it locally.
git clone https://github.com/lebinh/ngxtop.gitcd ngxtop# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- Requires direct or SSH access to log files; ensure file permissions and log format string match actual nginx/Apache configuration.
- Supports Python 2 and 3, but Python 2 is EOL; upgrade to Python 3 before deployment to avoid security and dependency issues.
- Follow mode (`--no-follow` flag absent by default) watches for new log lines; initial runs may miss historical data unless explicitly enabled.
- Custom log formats require exact string match to nginx `log_format` directive; misalignment causes silent parse failures.
- Filter and group-by expressions are flexible but undocumented syntax; test expressions on small log samples before production use.
When to avoid it — and what to weigh
- Need persistent, long-term metrics storage — ngxtop is designed for short-lived interactive use, not for persisting metrics to time-series databases or building historical dashboards.
- Require alerting or automated escalation — No built-in alerting, thresholds, or integrations with PagerDuty, Slack, or other incident systems; manual inspection only.
- Monitoring high-volume servers (millions of req/sec) — Python-based log parsing may struggle with extreme throughput; purpose is interactive troubleshooting, not production streaming analytics.
- Need correlated logs with application metrics — ngxtop shows only web server access patterns; does not integrate with APM, distributed tracing, or application performance monitoring.
License & commercial use
Licensed under MIT (MIT License), which is an OSI-approved permissive open-source license allowing commercial use, modification, and distribution with minimal restrictions (retain license notice).
MIT License permits commercial use without fee or royalty. You may use ngxtop in proprietary products, charge customers, and modify code freely provided you include the MIT license notice. No liability or warranty is provided; confirm compliance with your legal team if integrating into commercial offerings.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Moderate |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Low |
| DEV.co fit | Possible |
| Assessment confidence | High |
ngxtop processes log files containing request headers, IPs, and URLs; ensure files are stored securely and not exposed in world-readable contexts. When piping remote logs via SSH, verify SSH keys are protected and SSH hosts are trusted. No encryption, signing, or audit logging of ngxtop operations; output is written to stderr/stdout, which may log sensitive data.
Alternatives to consider
Prometheus + node_exporter + nginx module
Production-grade metrics collection and long-term storage with alerting; requires more setup but scales to large deployments and integrates with Grafana.
Datadog / New Relic agents
Commercial SaaS platforms with built-in nginx/Apache dashboards, alerting, and correlated application metrics; higher cost but managed and feature-rich.
GoAccess
Faster C-based log analyzer with real-time terminal UI and HTML/JSON export; similar use case but better performance for high-traffic logs.
Build on ngxtop with DEV.co software developers
ngxtop excels at ad-hoc diagnostics, but for persistent metrics, alerting, and correlated observability across your infrastructure, Devco can help you architect and deploy Prometheus, Grafana, Datadog, or custom monitoring solutions.
Talk to DEV.coRelated on DEV.co
Explore the category and the services that help you build with it.
ngxtop FAQ
Can ngxtop parse logs from S3 or cloud storage?
Does ngxtop require nginx to be recompiled or modified?
What happens if the log format does not match the nginx config?
Is ngxtop suitable for monitoring production 24/7?
Work with a software development agency
DEV.co helps companies turn open-source tools like ngxtop into production software. Our software development services cover the full lifecycle — architecture, web development, integration, and maintenance — delivered by software developers and web developers who ship. Engage our software development agency to implement or customize it for your open-source observability stack.
Need Production Monitoring Beyond ngxtop?
ngxtop excels at ad-hoc diagnostics, but for persistent metrics, alerting, and correlated observability across your infrastructure, Devco can help you architect and deploy Prometheus, Grafana, Datadog, or custom monitoring solutions.