-1

Is there a shell command to group all the most common IPs that requested a specific file via GET (or that came from a url)?

For example with this command I can group requests from ip:

cat /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 20

With this one I can search for "MYURL"

grep 'MYURL' /usr/local/apache/logs/access_log | sort -nr | uniq -c | sort -nr -k1 | tail -n 20

What I need is to put these 2 commands together and print the most common IPs that requested "MYURL", is that possible?

PS: also it would be nice if the log used is "/usr/local/apache/logs/error_log" and not "access_log"

closed as unclear what you're asking by kasperd, mdpc, dawud, Scott Pack, MadHatter Apr 18 '15 at 5:38

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • yes sorry shell command – ipel Apr 17 '15 at 11:48
3

You've got all the components you need there - I'm surprised you can't make the jump to combine them yourself. Just change the first command in your first pipeline to the grep at the start of the second one ...

grep 'MYURL' /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 20

I don't understand why you would want to parse error_log rather than access_log for this - lines in the error log aren't structured like in the access log.

  • thank you but it doesn't show the most used IPs in this way – ipel Apr 17 '15 at 14:39
  • What does it show? It should give the same report as your first pipeline but only considering log entries for the specified URL. – Paul Haldane Apr 17 '15 at 15:37
0

Yes,just convine both with a pipe, and remove what you do not need,

Something like this will do:

grep $MYURL /usr/local/apache/logs/access_log | awk '{print $1}' | sort -nu

Not the answer you're looking for? Browse other questions tagged or ask your own question.