To compare "the site works" with the complaints, you need a count: what share of requests was served properly.
curl checked one request — its own. Over the same hours the customers sent thousands, and nginx wrote each of them as a line in access.log (the access log) with an answer code. A service is judged by all of those requests at once.
Such a count is called an SLI (Service Level Indicator) — the share of good events among all events. For a site an event is a request, and the availability SLI is the share of good answers:
Whether an answer is good depends on the code's class — its first digit:
| Class | Example | For availability |
|---|---|---|
| 2xx | 200 — the answer was served | good |
| 3xx | 304 — the browser has a fresh copy | good |
| 4xx | 404 — no such address | good: the client made a mistake |
| 5xx | 500, 502, 503, 504 — a failure on the server | bad |
The 404 answers in this log are requests for /favicon.ico and /wp-login.php, which the shop does not have. The site answered them correctly. A bad answer is when the request was fine and the service failed to handle it, that is, a 5xx.
The answer code is the line's ninth field, $9 in awk. awk compares a field of digits as a number, so the condition $9 >= 500 picks the bad answers, and NR at the end is the number of all lines:
What happens to the availability of the whole log if the 404 answers count as bad too?
-
Availability is the share of good answers: one bad answer does not zero it. 404s are about 5 % of the lines, and that is how far it drops.
-
They do: in the
uniq -coutput at the start of the lesson 404 is the second most frequent code after 200. -
The denominator is all the log's lines, and it stays the same. The number of good ones changes: the 404s move to the bad.
404s are about 5 % of the log's lines: counting them as bad drops the availability from about 97 to 92 %. The site answered them correctly — the shop has no /favicon.ico or /wp-login.php — so the availability SLI counts them as good.
Key points
- An SLI is the share of good events among all events; for a site an event is a request, and the availability SLI is the share of good answers.
- Bad answers are 5xx: a failure on the server's side. With 2xx, 3xx and 4xx answers the service coped.
- One curl checks one request; an SLI covers all the customers' requests over the counted time.