0

I have the Apache access logs. I want a list of IPs sorted by number of accesses they have made (count) but not the count number. Just the IP addresses sorted by access counts.

I have this command I've found here:

cat access_log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -200 > output.txt

This gives an output like:

10000 66.249.79.18

10000 is the count number. I need the IP only not the count. What is the modified command then?

halfer
  • 19,824
  • 17
  • 99
  • 186
sd100
  • 83
  • 1
  • 8
  • 1
    Do you mind sharing some of the apache access_log output? – SomeGuyOnAComputer Apr 26 '18 at 23:52
  • Possible duplicate of [Sort unique IP address in from Apache log](https://stackoverflow.com/q/18682308/608639), [Sorting IP address according to the second field in file](https://unix.stackexchange.com/q/71704/56041), etc. – jww Oct 11 '18 at 04:26

1 Answers1

1

Try removing the -c for the uniq command. This will eliminate the first column which is the count.

Full command

cat access_log | awk '{print $1}' | sort -n | uniq | sort -nr | head -200
SomeGuyOnAComputer
  • 5,414
  • 6
  • 40
  • 72
  • Thanks the next question is I have a list now, of unique ip addresses. How do I resolve these to hostnames? Is there any script you can share here? thanks! – sd100 Apr 27 '18 at 00:21
  • @sd100 that's a separate question but I'd use `nmblookup` or `nslookup`. See [this page for more details](https://serverfault.com/a/88129). – SomeGuyOnAComputer Apr 27 '18 at 00:48