Get top 10 ips from an apache log

robertjinx · 08-20-2012, 02:46 PM

Hello, how would you guys get the top 10 of ips from an apache log based on how many times they appear?

for example we have ip 10.0.10.1 50 times, 192.168.10.1 38 times, and so on, plus a tones of other ips which got only 1-2 hits.

How would you write a script that will get the 10 ip addresses that access a certain website based on the apache logs?

Kustom42 · 08-20-2012, 02:59 PM

This can be done in a more robust fashion but here is an easy quick way. If this is something you are going to rely upon heavily look at re-writing it to perl, python or something that can handle it better.

Code:

#!/bin/bash

##First create a temp file that you can use to manipulate the IPs.

/bin/cut -f1 -d" " /var/log/httpd/access_log | sort -n > /tmp/iplist.txt

### Now we do the counting and sorting

for ip in $(/bin/cat /tmp/iplist.txt | uniq)
do
IPCOUNT=$(grep $ip /tmp/iplist.txt | wc -l)
echo "$IPCOUNT connections from $ip" >> /tmp/ipcount.txt
done

### Now we do the reporting by pulling from the file

/bin/sort -nr /tmp/ipcount.txt > /tmp/ipresults.txt
/usr/bin/head -n10 /tmp/ipresults.txt

/bin/rm -f /tmp/iplist.txt
/bin/rm -f /tmp/ipcount.txt
/bin/rm -f /tmp/ipresults.txt

robertjinx · 08-20-2012, 03:06 PM

Ahh, something like this I've done too, was thinking something more "better" or more "cleaner".

Thanks anyway!

centos123 · 08-22-2012, 02:52 AM

Quote:

Originally Posted by Kustom42

### Now we do the reporting by pulling from the file

/bin/sort -nr /tmp/ipcount.txt > /tmp/ipresults.txt
/usr/bin/head -n10 /tmp/ipresults.txt

/bin/rm -f /tmp/iplist.txt
/bin/rm -f /tmp/ipcount.txt
/bin/rm -f /tmp/ipresults.txt

[/CODE]

this part remove txt file then how will we see when it doesnot exist?

and i tried but it not working

/bin/sort: open failed: /tmp/ipcount.txt: No such file or directory

Kustom42 · 08-22-2012, 11:37 AM

Quote:

Originally Posted by centos123

this part remove txt file then how will we see when it doesnot exist?

and i tried but it not working

/bin/sort: open failed: /tmp/ipcount.txt: No such file or directory

I'm not sure I understand you, these are temporary text files created by the script, they should not already exist.