Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am having trouble getting my IP addresses from my site's server log out from amidst the mess of other data in a server log. Before I crack open Excel I know there's a way to do it because I found the opposite of what I want, removing IP 's from AWS:

cat web.log | awk '{$1=$2=$3=""}1' > web-no-ip.log

A step by step or cheat sheet for this kind of thing would be amazing.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I'm assuming that IP addresses are in the typical format of X.X.X.X where X is between [0,255]. Knowing that, grep can do the job quite admirably:

grep -oP '(0|[01]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])(\.(0|[01]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])){3}' filename.txt

(0|[01]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]) will match any number between 0 and 255, including leading zeroes--for example, 0, 255, 019, etc.. As written, however, it will match things like (five octets). This also does not track IPV6 addresses.

If you expect the logs to ONLY contain valid IP addresses that look like X.X.X.X, and we can ASSUME that X is not going to be invalid, you can use a much simpler expression:

grep -oP '\d{1,3}(\.\d{1,3}){3}' filename.txt
share|improve this answer
My hosting support came back with this for anyone else: Your command is good to list the IP addresses from the raw access logs, but that will not sort or count the IP addresses in the logs and if the logs contain thousands number of entries, it will be hard to read the output. I recommend you to use this command to sort the IP addresses from the raw access logs: cat /home/username/access-logs/domain.com | awk '{print $1}' | sort -n | uniq -c | sort -n –  BenRacicot Aug 15 '13 at 1:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.