Apache Logs / Grep Command Help Needed

Question

I need to be able to see all requests made by an IP in a given day.

I'm not familiar with grep and was wondering if anyone could give me a hand.

Answer 1

Is there anyway I can limit the search results to an specific day?

I like awk for a question like this; you can match multiple fields in a single command. If we assume you're using a standard Apache log format, field 1 is the IP address and field 5 is the date of the access:

$ awk '$1 ~ /8\.8\.8\.8/ && $4 ~ /15\/Dec\/2009/ { print }' /var/log/apache2/access.log

awk processes each line in a file and splits it on whitespace into variables named $1, $2, and so on. You can match them with the $2 ~ /REGEX/ syntax, and you can match on multiple fields.

Apache stores the date in the ridiculous DD/Mon/YYYY format, so you need to escape the / character, which makes matching dates a little unwieldy.

A solitary { print } will print the whole line (awk also knows this as $0). If you only want to emit specific fields, you can add those to the print statement. If you only wanted to print the requested URI, you would do:

$ awk '$1 ~ /8\.8\.8\.8/ && $4 ~ /15\/Dec\/2009/ { print $7 }' /var/log/apache2/access.log

Since the request URI is field 7 in the log.

Answer 2

Assuming that your log is at /var/log/apache2/access.log and assuming that your Apache logs are in common or combined format:

$ grep "^w\.x\.y\.z" /var/log/apache2/access.log

e.g. to search for 127.0.0.1

$ grep "^127\.0\.0\.1" /var/log/apache2/access.log