Home / ubuntu / Questions / 1059504
In Process
alebal
Asked: 2018-07-26 13:44:00 +0800 CST

Understand which IP accesses more my server via terminal

  • 772

I occasionally use this line in my terminal to see which user-agent is using my server more.

cat /var/log/apache2/access.log | awk -F\" '{print $6}' | sort | uniq -c | sort -n

Scans the access.log and show in ascending order the user-agents that it has found several times.

The result is something like this:

  10283 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1
  23247 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
  40063 MauiBot ([email protected])
 143724 Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
 192741 Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)

I have no idea how it works, so long ago I found it somewhere or someone gave me the date, I do not remember.

Anyway, is possible do the same thing but ordering for IP?

command-line text-processing ip

2 Answers

  1. I think IP is the on the first column in the log, try

    awk '{print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -n
    • 0

  2. Judging from the fact that you're using awk -F \" { print $6} there, this appears like combined log format, which should have the IP address in field $1. From there, we can just do uniq in awk, then combine that with sorting indices in associative arrays.

    With a mock access.log file like this:

    127.0.0.1 - - [05/Feb/2012:17:11:55 +0000] "GET / HTTP/1.1" 200 140 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.5 Safari/535.19"
192.168.0.2 - - [05/Feb/2012:17:11:55 +0000] "GET / HTTP/1.1" 200 140 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.5 Safari/535.19"
127.0.0.1 - - [05/Feb/2012:17:11:55 +0000] "GET / HTTP/1.1" 200 140 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.5 Safari/535.19"

    the awk code should be as so:

    $ awk '{!a[$1]++}; END{n=asorti(a,sorted);for(i=1;i<=n;i++) print sorted[i],":",a[sorted[i]]}' access.log
127.0.0.1 : 2
192.168.0.2 : 1

    For numeric sorting by the number of entries for each ip address, we can just stick sort at the end:

    $ awk '{!a[$1]++}; END{for(val in a) print val,":",a[val];}' access.log | sort -n --field-separator=":" -k 2,2

    Of course, you should use /var/log/apache2/access.log as your actual input file.

    • 0