apache: show most frequest IPs from log file

There are times when you doubt that something strange is happening with your site. You might be suspecting some kind of attack. Apache logs can help you to quickly summarize number of requests coming from various IP addresses.

Following command will display 20 IP addresses that were accessing your website most frequently, sorted so that most frequent are on top.

cat path-to-log-file.log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -20

Notes:

  1. Apache log files are usually located in /var/log/apache2
  2. This won’t help if you have a reverse proxy in front of your website, then almost all requests will be coming from IP address of the reverse proxy

By Aleksandar Jakovljević

My name is Aleksandar Jakovljević and I am a web developer from Belgrade, Serbia. I was born in Smederevo, in 1980. I started focusing on web development since late 2003. I am mostly focused on open source web technologies. I specialised in PHP, focusing on Symfony framework, with skills in Drupal and WordPress, too. I worked more than 7 years for art_net studio. I work for Computer Rock (former Spoiled Milk) since April 2011. I love the web and everything related to it. The possibility to publish your ideas quickly and make them available to the entire world is what made me decide to pursue a career in web development.

Follow on: Twitter | GitHub | LinkedIn | Facebook | Instagram

Leave a comment

Your email address will not be published. Required fields are marked *