Is there a shell command to group all the most common IPs that requested a specific file via GET (or that came from a url)?

For example with this command I can group requests from ip:

cat /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 20

With this one I can search for "MYURL"

grep 'MYURL' /usr/local/apache/logs/access_log | sort -nr | uniq -c | sort -nr -k1 | tail -n 20

What I need is to put these 2 commands together and print the most common IPs that requested "MYURL", is that possible?

PS: also it would be nice if the log used is "/usr/local/apache/logs/error_log" and not "access_log"

  • yes sorry shell command – ipel Apr 17 '15 at 11:48

You've got all the components you need there - I'm surprised you can't make the jump to combine them yourself. Just change the first command in your first pipeline to the grep at the start of the second one ...

grep 'MYURL' /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 20

I don't understand why you would want to parse error_log rather than access_log for this - lines in the error log aren't structured like in the access log.

  • thank you but it doesn't show the most used IPs in this way – ipel Apr 17 '15 at 14:39
  • What does it show? It should give the same report as your first pipeline but only considering log entries for the specified URL. – Paul Haldane Apr 17 '15 at 15:37

Yes,just convine both with a pipe, and remove what you do not need,

Something like this will do:

grep $MYURL /usr/local/apache/logs/access_log | awk '{print $1}' | sort -nu

Not the answer you're looking for? Browse other questions tagged or ask your own question.