I found the following code to see which IP Addresses has the highest hits:

FILE=access.log; for ip in cat $FILE |cut -d ' ' -f 1 |sort |uniq; do { COUNT=grep ^$ip $FILE |wc -l; if [[ "$COUNT" -gt "500" ]]; then echo "$COUNT: $ip"; fi }; done

The above code displays the IP address with more than 500 hits (i.e. access on the site by opening the URL)

But that script is too slow. Is there any other code that create the same output?

Plus, how to display the top 10 results only that has the highest hits or access on the URL?

  • how big is the access.log file? – tony roth Jul 11 '13 at 13:56
  • Average 125MB/day.. – jaYPabs Jul 11 '13 at 13:57
  • Try log aggregation with Logstash and Kibana. – Tom O'Connor Jul 11 '13 at 14:35
  • 1
    Short answer: yes. cut -d' ' -f1 access.log | sort | uniq -c | awk '$1 ~ /[5-9][0-9][0-9]|[0-9][0-9][0-9][0-9]+/'. Only reads through your access log once rather than once per IP address. You can add | sort -n on the end if you want them sorted by hits. – Ladadadada Jul 11 '13 at 15:23

You're re-inventing the wheel. Try this:

sed -e 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*$/\1/' -e t -e d access.log | sort | uniq -c
  • Thanks. How to get top 10 or top 20 only with highest hits? – jaYPabs Jul 11 '13 at 14:02
  • Just add '| head -n 20' to the end of the command above. – slhsen Dec 30 '15 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.