SLI: the share of good requests

The log keeps three hours, and the complaints are about the last one. An SLI is always counted over a time window.

The command above printed about 97 %: three hours of the shop's work went into the count, and two calm hours diluted the last one. That is why an SLI is named together with its window: "availability over the last hour", "over a day", "over 30 days". The same requests give different SLIs in different windows.

To select a window, you need each request's time. The shop's log is written in the sre format — the log_format directive sets it:

cat /etc/nginx/conf.d/lab-sre-log.conf

It is the familiar combined format plus two fields at the end. $request_time is how many seconds nginx spent on the request. $msec is the moment of the request in unix time: seconds since 1 January 1970 UTC, with milliseconds after the dot. In awk the line's last field is $NF, the one before it is $(NF-1).

Unix time is a single number, so a plain comparison sets the window: a line belongs to the last hour if its $NF is not less than "now minus 3600 seconds". date prints that number: date +%s is the current unix time, date -d '1 hour ago' +%s is an hour ago. The -v option passes the value into the awk program:

from=$(date -d '1 hour ago' +%s); log=/var/log/nginx/access.log
sudo awk -v from="$from" '$NF >= from' "$log" | wc -l