shell command to find common IPs on a specific url from error_log [closed]

Question

Is there a shell command to group all the most common IPs that requested a specific file via GET (or that came from a url)?

For example with this command I can group requests from ip:

cat /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 20

With this one I can search for "MYURL"

grep 'MYURL' /usr/local/apache/logs/access_log | sort -nr | uniq -c | sort -nr -k1 | tail -n 20

What I need is to put these 2 commands together and print the most common IPs that requested "MYURL", is that possible?

PS: also it would be nice if the log used is "/usr/local/apache/logs/error_log" and not "access_log"

Answer 1

You've got all the components you need there - I'm surprised you can't make the jump to combine them yourself. Just change the first command in your first pipeline to the grep at the start of the second one ...

grep 'MYURL' /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 20

I don't understand why you would want to parse error_log rather than access_log for this - lines in the error log aren't structured like in the access log.

Answer 2

Yes,just convine both with a pipe, and remove what you do not need,

Something like this will do:

grep $MYURL /usr/local/apache/logs/access_log | awk '{print $1}' | sort -nu