Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found the following code to see which IP Addresses has the highest hits:

FILE=access.log; for ip in cat $FILE |cut -d ' ' -f 1 |sort |uniq; do { COUNT=grep ^$ip $FILE |wc -l; if [[ "$COUNT" -gt "500" ]]; then echo "$COUNT: $ip"; fi }; done

The above code displays the IP address with more than 500 hits (i.e. access on the site by opening the URL)

But that script is too slow. Is there any other code that create the same output?

Plus, how to display the top 10 results only that has the highest hits or access on the URL?

share|improve this question
how big is the access.log file? – tony roth Jul 11 '13 at 13:56
Average 125MB/day.. – jaYPabs Jul 11 '13 at 13:57
Try log aggregation with Logstash and Kibana. – Tom O'Connor Jul 11 '13 at 14:35
Short answer: yes. cut -d' ' -f1 access.log | sort | uniq -c | awk '$1 ~ /[5-9][0-9][0-9]|[0-9][0-9][0-9][0-9]+/'. Only reads through your access log once rather than once per IP address. You can add | sort -n on the end if you want them sorted by hits. – Ladadadada Jul 11 '13 at 15:23
Thanks @Ladadadada – jaYPabs Jul 12 '13 at 12:08

You're re-inventing the wheel. Try this:

sed -e 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*$/\1/' -e t -e d access.log | sort | uniq -c
share|improve this answer
Thanks. How to get top 10 or top 20 only with highest hits? – jaYPabs Jul 11 '13 at 14:02
Just add '| head -n 20' to the end of the command above. – slhsen Dec 30 '15 at 13:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.