web_traffic_summary
Summarize web server access logs from a managed instance: view request volume, status codes, top client IPs, and top URLs. Automatically discovers nginx, apache, or httpd logs.
Instructions
Summarize a managed instance's OWN web access logs (X-Forwarded-For / mod_remoteip aware): per-vhost request volume, approx req/s, status-code mix, top client IPs and top URLs. Reads the decisive on-box data that cloudwatch_top_ips (WAF logs only) cannot see. Auto-discovers nginx/apache/httpd logs when log_path is omitted. Read-only.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | Instance ID, name, or custom-server name. | |
| log_path | No | Explicit access-log path. Empty = auto-discover nginx/apache/httpd access logs. | |
| lines | No | Lines to tail per log file (100–200000, default 10000). | |
| top_n | No | How many top IPs/URLs to report (1–100, default 15). |