Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So someone in China just loves abusing the crap out of my networking tools site up at

I've been trying to analyze my access.log files to see exactly what they are so excited about. Most of the services on my site are rate limited using MySQL calls to record a history of usage, and for the most part that has been a great way to curb excessive use. Every once and awhile they will use a ton of IP addresses to hit the service up to avoid the IP rate limit.

I've been playing around with these two commands to analyze my Apache access.log file:

sudo cat access.log | awk '{print $1}' | sort | uniq -c |sort -n

// Output sample:
// 3453
// 3888
// 4268
// 7116


sudo tail -50000 access.log | awk '{print $1}' | sort | uniq -c |sort -n

// Output sample:
// 276
// 365
// 1093

and lastly:

awk '{print $7}' access.log|cut -d? -f1|sort|uniq -c|sort -nk1|tail -n10

// Output sample:
// 15405 heavy-use-file.php
// 22339 heavy-use-file.php
// 218121 very-heavy-use-file.php

The last thing I need is something that will tie the access counts, IP addresses, and files all together. Is it possible to write a shell command that will show me the IP addresses that have made the most requests, and specifically which file they have been requesting descending by count? I'm not a Linux master, so I'm reaching out for help here.

share|improve this question

How about :

awk '{print $1,$7}' access.log | cut -d? -f1 | sort | uniq -c |sort -nr

Also have you had a look at AWStats ? It's quite awesome to analyse all data from your log files

share|improve this answer

apachetop is your friend. It provides you a view similar to top command, but for Apache access log. It is possible to sort the view by hits, kbytes and so on.

You can use it in real time or feed an older log to it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.