Shulou(Shulou.com)06/01 Report--

This article mainly explains "Shell how to count ip access and analyze the access log". Interested friends may wish to take a look. The method introduced in this paper is simple, fast and practical. Let's let the editor take you to learn how Shell counts ip access and analyzes the access log.

Topic requirement

There is a log 1.log, some of which are as follows:

112.111.12.248-[25/Sep/2013:16:08:31 + 0800] formula-x.haotui.com "/ seccode.php?update=0.5593110133088248" 200 "http://formula examples x.haotui.com/registerbbs.php"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1 SV 1) ) "61.147.76.51-[25/Sep/2013:16:08:31 + 0800] xyzdiy.5d6d.com" / attachment.php?aid=4554&k=9ce51e2c376bc861603c7689d97c04a1&t=1334564048&fid=9&sid=zgohwYoLZq2qPW233ZIRsJiUeu22XqE8f49jY9mouRSoE71 "301" http://xyzdiy.5d6d.com/thread-1435-1-23.html"Mozilla/4.0 (compatible; MSIE 6.0 / SV1; NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"

Count the number of visits to each IP

Exercise analysis

The need for this kind of analysis log is very common in daily work, and there is a lot of frequency in the written examination questions when looking for operation and maintenance work.

According to the contents of the log, you can see that the IP address is the first paragraph, so you only need to filter out the first paragraph of 1.log, and then count the amount of each IP further.

Filtering the first paragraph can be easily obtained using awk, while counting the number of visits to each IP requires sorting and then calculating the number.

Sort using the sort command and count the number of visits to each IP using uniq.

Awk'{print $1} '1.log | sort-n | uniq-c | sort-n answer parsing 1. The awk command still has an advantage in segmentation. Here {print $1} says the first paragraph is printed, and awk can specify the delimiter with-F. if you do not specify the delimiter, the default is a blank character (such as space, Tab, etc.). In this question, the IP address is in the first paragraph. 2. The sort command is a sort command, and the-n option indicates that it is sorted in the form of numbers. If you do not add-n, it is sorted in ASCII. It is easier to distinguish the IP addresses in this question by sorting in the form of numbers. 3. The uniq command is used to repeat. If multiple lines in a text are exactly the same, you can use the uniq command to delete the lines of the same content, leaving only one line. The function of the-c option is to calculate the number of duplicate lines, so using uniq-c in this question is just enough to calculate the number of visits to IP addresses. However, we must note that the premise of de-duplicating uniq is to sort it first. 4. In the answer to this question, there is no sort-n means to sort by the number of visits, the greater the number of requests, the more IP ranks behind. If you want to be in the front, you can add a-r option, that is, sort-nr. I believe you have a deeper understanding of "Shell how to count ip access and analyze the access log". You might as well do it in practice. Here is the website, more related content can enter the relevant channels to inquire, follow us, continue to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.