0

Need help in capturing an hourly request count specific to login sessions only.

I found a command set online while doing some searches. The command returns an hourly count of requests found in the access.log.

grep "23/Jan" progolfdeal.com | cut -d[ -f2 | cut -d] -f1 | awk -F: '{print $2":00"}' | sort -n | uniq -c

I was trying to obtain an hourly request count however it returns all type of requests and the count returned is not matching a specific login count that I'm trying to obtain.

Please help with a query that can include the as well the login count specific to the URL found the access.log. I will see entries in the log pertaining to the website in the following format \mysite\logon.jsp 200 xxxx & that is what I'm trying to count as well.

Thank you.

1 Answer 1

0

Just add a regex to grep to specify initial strings with GET in them:

grep [23/Jan*.GET*.progolfdeal.com] | cut -d[ -f2 | cut -d] -f1 | awk -F: '{print $2":00"}' | sort -n | uniq -c
12
  • Thank you for the command provided. What is the exact command after GET*. if the file being accessed is named access.log.003098 ? Thanks. Jan 27, 2019 at 7:27
  • You need to provide input for this command just pipe it to the cat like this cat access.log.003098 | grep [23/Jan*.GET*.progolfdeal.com] | cut -d[ -f2 | cut -d] -f1 | awk -F: '{print $2":00"}' | sort -n | uniq -c
    – nethero
    Jan 28, 2019 at 9:04
  • Thank you very much. I'm trying to test the count of the instance of the following in the log file, the log file entry value is - Jan 28, 2019 at 13:53
  • Thank you very much. Pls help in modifying the command with capturing the log entry value " app/login.jsp? " I'm trying to test the count of the login attempt with the log file entry value is - app/login.jsp? --- I tried to use the updated command --- $ cat access.log.003098 | grep [23/Jan*.app/login.jsp?] | cut -d[ -f2 | cut -d] -f1 | awk -F: '{print $2":00"}' | sort -n | uniq -c --- however it doesn't return the correct count. It does return all the request count in the log file which is totalling to 120. Manual count for " app/login.jsp?" will give a total count of three. Jan 28, 2019 at 15:38
  • To start with, could you please mark my answer as an answer and vote it up as I feel like I've answered your initial question. You need to understand that when you are doing that grep [23/Jan*.app/login.jsp?] it returns every line containing 23/Jan followed by any number of any characters (thats what *. is for) followed by app/login.jsp? although caracters like / and ? should be escaped. From here i can't help you without seeing your log file to know how to write proper regex. I think that now, you should learn how to use regex it will make your life easier.
    – nethero
    Jan 30, 2019 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .