Question

由apache seb服务器生成access_log 需要找到从Web服务器到IP的最大呼叫数如何在apache web服务器上找到前5个IP，给定access_log文件？

64.242.88.10 - - [08/Mar/2004:02:45:03 -0800] "GET /twiki/bin/search/TWiki/?scope=topic&regex=on&bookview=on&search=.* HTTP/1.1" 200 102399
64.242.88.10 - - [08/Mar/2004:02:46:12 -0800] "GET /twiki/bin/edit/Main/Local_recipient_maps?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12851
64.242.88.10 - - [08/Mar/2004:02:47:58 -0800] "GET /mailman/listinfo HTTP/1.1" 200 6893
lj1025.inktomisearch.com - - [08/Mar/2004:02:48:05 -0800] "GET /twiki/bin/oops/Main/KevinWGage HTTP/1.0" 200 209
prxint-sxb3.e-i.net - - [08/Mar/2004:02:50:53 -0800] "GET /twiki/bin/view/Main/WebHome HTTP/1.0" 200 10392
prxint-sxb3.e-i.net - - [08/Mar/2004:02:50:54 -0800] "GET /twiki/pub/TWiki/TWikiLogos/twikiRobot46x50.gif HTTP/1.0" 200 2877
64.242.88.10 - - [08/Mar/2004:02:52:39 -0800] "GET /twiki/bin/view/Main/PostfixCmd HTTP/1.1" 200 4173
prxint-sxb2.e-i.net - - [08/Mar/2004:02:54:29 -0800] "GET /twiki/bin/view/Main/SpamAssassinAndPostFix HTTP/1.0" 200 4022
64.242.88.10 - - [08/Mar/2004:02:54:54 -0800] "GET /twiki/bin/edit/TWiki/NewTopic?topicparent=TWiki.WikiSyntax HTTP/1.1" 401 12846
64.242.88.10 - - [08/Mar/2004:02:59:03 -0800] "GET /twiki/bin/rdiff/TWiki/TWikiSite HTTP/1.1" 200 71941
64.242.88.10 - - [08/Mar/2004:03:01:12 -0800] "GET /twiki/bin/rdiff/TWiki/SimultaneousEdits HTTP/1.1" 200 6180
64.242.88.10 - - [08/Mar/2004:03:06:31 -0800] "GET /twiki/bin/view/Main/NicholasLee?rev=1.2 HTTP/1.1" 200 3570
64.242.88.10 - - [08/Mar/2004:03:07:59 -0800] "GET /twiki/bin/view/TWiki/TWikiHistory?rev=1.9 HTTP/1.1" 200 15756
64.242.88.10 - - [08/Mar/2004:03:09:20 -0800] "GET /mailman/listinfo/ncbnpfaculty HTTP/1.1" 200 6331

Answer 1

您可以使用cut，sort和uniq的管道。

cut -f1 -d" " log.txt |  # Using " " as delimiter, retrieve 1st field of each line
   sort |                # Sort the output; `uniq` needs sorted input
   uniq -c |             # `c`ount the unique values
   sort -nr |            # Sort `n`umerically in `r`everse
   head -n5              # and only output the first 5 lines.

对于您的输入，输出为

  10 64.242.88.10
   2 prxint-sxb3.e-i.net
   1 prxint-sxb2.e-i.net
   1 lj1025.inktomisearch.com

Answer 2

awk 解决方案：

$ awk '{a[$1]++} END{for (i in a) print i, a[i]}' input.txt | sort -nr -k2 | head -n5
64.242.88.10 10
prxint-sxb3.e-i.net 2
prxint-sxb2.e-i.net 1
lj1025.inktomisearch.com 1

结果：

$vndg = (Get-Date).ToString("dd-MM-yyyy")
$morg = (Get-Date).AddDays(+1).ToString("dd-MM-yyyy")

[XML]$SOAP = @'
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <Clocking_GetByDateRangeUtc xmlns="http://www.geodynamics.be/webservices">
      <caller>
        <CompanyName>companyname</CompanyName>
        <LoginName>username</LoginName>
        <Password>password</Password>
      </caller>
      <fromDateUtc>$vndg</fromDateUtc>
      <toDateUtc>$morg</toDateUtc>
    </Clocking_GetByDateRangeUtc>
  </soap:Body>
</soap:Envelope>
'@

$headers = @{"SOAPAction" = "http://www.geodynamics.be/webservices/Clocking_GetByDateRangeUtc"}
$destination = 'C:\Temp\GeoDynamics\Downloads\GeoPers.xml'

$URI = "https://secure.geodynamics.be/webservices/intellitracer/1.0/IntegratorWebservice.asmx?WSDL"
$out = Invoke-WebRequest $uri -Method Post -ContentType 'text/xml' -Body $SOAP -Headers $headers -OutFile $destination

Answer 3

bash中的解决方案，替换＆＃39; log＆＃39;用你的文件名。

{{1}}

如何找到前5个IP访问apache web服务器，给出access_log文件？

3 个答案: