There are times when you doubt that something strange is happening with your site. You might be suspecting some kind of attack. Apache logs can help you to quickly summarize number of requests coming from various IP addresses.

Following command will display 20 IP addresses that were accessing your website most frequently, sorted so that most frequent are on top.

cat path-to-log-file.log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -20

Notes:

  1. Apache log files are usually located in /var/log/apache2
  2. This won’t help if you have a reverse proxy in front of your website, then almost all requests will be coming from IP address of the reverse proxy