Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to be able to see all requests made by an IP in a given day.

I'm not familiar with grep and was wondering if anyone could give me a hand.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Is there anyway I can limit the search results to an specific day?

I like awk for a question like this; you can match multiple fields in a single command. If we assume you're using a standard Apache log format, field 1 is the IP address and field 5 is the date of the access:

$ awk '$1 ~ /8\.8\.8\.8/ && $4 ~ /15\/Dec\/2009/ { print }' /var/log/apache2/access.log

awk processes each line in a file and splits it on whitespace into variables named $1, $2, and so on. You can match them with the $2 ~ /REGEX/ syntax, and you can match on multiple fields.

Apache stores the date in the ridiculous DD/Mon/YYYY format, so you need to escape the / character, which makes matching dates a little unwieldy.

A solitary { print } will print the whole line (awk also knows this as $0). If you only want to emit specific fields, you can add those to the print statement. If you only wanted to print the requested URI, you would do:

$ awk '$1 ~ /8\.8\.8\.8/ && $4 ~ /15\/Dec\/2009/ { print $7 }' /var/log/apache2/access.log

Since the request URI is field 7 in the log.

share|improve this answer
    
This is exactly what I needed. Thx –  Jeff Dec 16 '09 at 1:34
add comment

Assuming that your log is at /var/log/apache2/access.log and assuming that your Apache logs are in common or combined format:

$ grep "^w\.x\.y\.z" /var/log/apache2/access.log

e.g. to search for 127.0.0.1

$ grep "^127\.0\.0\.1" /var/log/apache2/access.log
share|improve this answer
    
Thank you. Is there anyway I can limit the search results to an specific day? –  Jeff Dec 15 '09 at 23:58
    
Something like: grep "^127\.0\.0\.1.* \[15\/Dec\/2009" /var/log/apache2/access.log –  Dennis Williamson Dec 16 '09 at 6:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.