Skip to main content

How to count instances of an IP address in a log file

I was looking for a quick and painless way to determine what IP addresses used our web app the most and stumbled across this excellent post. I got reminded of the power of the command-line interface and that often, I underestimate the way these commands are supposed to make a sysad's life easier.


So here's a quick tip for counting unique visitors to your web app. Locate your web app's log file and do a quick scan of the last few lines. In my case, this is what I saw:


112.198.79.223 - - [10/Jul/2010:00:57:29 -0400] "POST /v2/api/execute.php?method=upload_time&ver=win1.1.15 HTTP/1.1" 200 116 "-" "Mozilla/5.0"
117.241.112.254 - - [10/Jul/2010:00:57:30 -0400] "POST /v2/api/execute.php?method=timestat&ver=win1.1.15 HTTP/1.1" 200 288 "-" "Mozilla/5.0"
80.249.84.105 - - [10/Jul/2010:00:57:29 -0400] "POST /v2/api/execute.php?method=offtime&ver=win1.1.15 HTTP/1.1" 200 19 "-" "Mozilla/5.0"
117.241.112.254 - - [10/Jul/2010:00:57:32 -0400] "POST /v2/api/execute.php?method=get_defaults&ver=win1.1.15 HTTP/1.1" 200 77 "-" "Mozilla/5.0"


In this log format, the IP address appears first, so we will only need to get the first set of characters, separated by a space. In order to count instances of an IP address, we sort the IP addresses so similar IP addresses are grouped together, then count them. Then we sort them again so that the sums are arranged. The number of unique IPs may give you pages of standard output, so optionally, if you only want to see which IP addresses accessed the web app the most, we look at the top results only.


So these are the commands used, piped one after the other, with the output:


[root@server2 ~]# cat /var/log/httpd/access_ssl.log | awk '{print $1}' | sort | uniq -c | sort -nr | head>


71612 216.157.78.237
34094 120.28.205.244
30091 119.93.97.54
25078 120.28.214.104
18949 120.28.195.151
17929 58.107.64.40
14877 212.98.174.235
14752 117.241.112.143
14429 120.28.247.74
12864 117.241.113.183
[root@server2 ~]#


Happy counting, err reporting!

Labels:

Comments

Post a Comment

Popular posts from this blog

Uncle Bong in SG

It's been over two decades since I last saw Uncle Bong. He would usually drop by Diamond Village in Novaliches, Quezon City to visit Lola Magding and my mother's side of the family there. Back then, I was still in college, and I think he had also just started working, in the automotive industry. He has since worked in cruise ships and it was a good stroke of fortune when he told me that they would be dry-docking in Singapore. Mama's side has always been close-knit and could see the fondness in his eyes as he recalled his dealings with Lola Magding and her children, Mama included. He would then share stories of how many of our relatives emigrated off the "isla" to find better opportunities in Manila. Given the brief opportunity, I'm still blessed to have seen him again after all these years. I am also happy that he was able to meet Mae and his "apos". Until we next see each other, Uncle Bong!
Post a Comment
Read more

Valentine Surprise

Each year, on Valentine's day, I usually surprise my darling wife with a letter/card, or a bouquet of roses. As it was a yearly thing, I knew she sort of expected these surprises; she'd look surprised, but I knew she wasn't really. Occasionally, she does get surprised. Like that time back in Cebu when I bought her a rather intricate bouquet of flowers. Her head spun when she found out how much I paid for it. Surprise! This year, however, is different. I was not able to prepare anything for her. I didn't get her anything, thinking that I'd just make up for it with dinner, or something. Yes, I didn't plan for this and I feel lousy actually. Last night, after my daughter gave me and my wife her home-made Valentine greeting cards, my wife started chiding me about what I was going to give her the next day. I gave her my usual "I'm not telling" smile and silently kicked myself. I wished I already had something ready, and I found myself already longing fo...
4 comments
Read more