Which bucket is using the most bandwidth? Which user is generating the most requests? Here is a small script I use to answer these questions directly from the terminal.

rgw-opstop reads RGW JSON operation logs and displays an interactive ranking by user, bucket, operation, IP address, HTTP status or error code. RX/TX rates are calculated over a rolling 60-second window by default.

Logs can be read locally or collected from several servers over SSH, with a combined view on your workstation. There are no external Python modules or persistent agents to install.

Download and run

Requirements: Bash and Python 3.8+ locally. SSH mode also requires an OpenSSH 8.7+ client, Python 3.8+ on each remote server and working non-interactive SSH access.

Note: RGW operation logs must be enabled (rgw_enable_ops_log = true) and written to JSON log files readable by the local or SSH user. See the Ceph documentation on logging settings.

curl -fsSLo rgw-opstop.sh https://raw.githubusercontent.com/ksperis/rgw-opstop/main/rgw-opstop.sh
bash rgw-opstop.sh --ssh rgw-01 --ssh rgw-02

Replace rgw-01 and rgw-02 with your hostnames or SSH aliases. To read local log files from the default locations, simply run bash rgw-opstop.sh.

Navigating the interface

Use the left/right arrow keys to switch views; b and o sort by bandwidth or operation count. Select a row and press Enter to apply a filter, which remains active when switching views. For example, select a bucket, then switch to the user view to see who is accessing it.

x shows only HTTP 4xx/5xx errors, c clears filters and q quits.

See the README for more options.