Home / server / Questions / 246522
Accepted
James Simpson
Asked: 2011-03-12 23:35:29 +0800 CST

Only view access_log entries from a certain IP in SSH

  • 772

I've got a large multi-year access_log and I need to view all of the entries for a certain IP address from SSH. The format is:

111.111.111.111 - ...

222.222.222.222 - ...

111.111.111.111 - ...

How would I only view the log entries for 111.111.111.111? I'm running CentOS.

linux centos logging ssh

2 Answers

  1. Best Answer

    Grep for it is the easiest way.

    grep "^111\.111\.111\.111\b" access_log
    • 4

  2. My obligatory gnu parallel answer:

    cat access_log | parallel --pipe -k grep ^111.111.111.111

    Note that requires a relatively recent version of parallel to work. The cool thing about this approach is it splits the file into multiple chunks and rungs grep on those chunks in parallel instead of running grep on the whole file. The -k option ensures that the ordering stays correct.

    For a very large file that could potentially be a lot faster than a simple grep. Something to try, anyway.

    • 2