Алерт при всплеске 5xx в nginx

#!/usr/bin/env bash
# /etc/cron.d/nginx-5xx-rate
# */1 * * * * root /opt/nginx-5xx.sh /var/log/nginx/access.log

LOG=${1:-/var/log/nginx/access.log}
WINDOW=60        # last N seconds
THRESH=10        # 5xx allowed per window
SINCE=$(date -d "-${WINDOW} seconds" '+%d/%b/%Y:%H:%M:%S')

COUNT=$(awk -v since="$SINCE" '
  $4 >= "["since {
    if ($9 ~ /^5/) c++
  }
  END { print c+0 }
' "$LOG")

if [ "$COUNT" -gt "$THRESH" ]; then
  curl -fsS -X POST "$SLACK_WEBHOOK" --data "{\"text\":\"nginx 5xx spike: $COUNT in last ${WINDOW}s\"}"
fi