WEB正确日志格式分析
#日志统计举例[root@master ~]# cat /etc/httpd/logs/access_log |awk '{print $1}'
#对IP排序[root@master ~]# cat /etc/httpd/logs/access_log |awk '{print $1}'|sort
#打印每一个重复出现IP的次数，[root@master ~]# cat /etc/httpd/logs/access_log |awk '{print $1}'|sort|uniq -c#排序并统计行数[root@master ~]# cat /etc/httpd/logs/access_log |awk '{print $1}'|sort|uniq -c|sort -rn|wc -l
#显示访问前10的IP地址[root@master ~]# cat /etc/httpd/logs/access_log |awk '{print $1}'|sort|uniq -c|sort -rn|head -10
#显示指定时间以后的日志[root@master ~]# cat /etc/httpd/logs/access_log |awk '$4>="21/Mar/2020:16:34:13"{print}'
#找出访问最大的IP地址并封掉[root@master ~]# cat /etc/httpd/logs/access_log |awk '{print $1}'|sort|uniq -c|sort -rn|more
#找出日志中下载最的几个css文件，[root@master ~]# cat /etc/httpd/logs/access_log |awk '($7~/css/){print $10" "$4" "$7" "$1}'|sort -n|uniq -c|sort -rn|head -106 241 [21/Sept/2024:16:34:52 /noindex/css/fonts/Light/OpenSans-Light.woff 192.168.1.56 240 [21/Sept/2024:16:34:52 /noindex/css/fonts/Light/OpenSans-Light.ttf 192.168.1.56 239 [21/Sept/2024:16:34:52 /noindex/css/fonts/Bold/OpenSans-Bold.woff 192.168.1.56 238 [21/Sept/2024:16:34:53 /noindex/css/fonts/Bold/OpenSans-Bold.ttf 192.168.1.55 241 [21/Sept/2024:16:34:53 /noindex/css/fonts/Light/OpenSans-Light.woff 192.168.1.55 240 [21/Sept/2024:16:34:53 /noindex/css/fonts/Light/OpenSans-Light.ttf 192.168.1.55 240 [21/Sept/2024:16:34:51 /noindex/css/fonts/Light/OpenSans-Light.ttf 192.168.1.55 239 [21/Sept/2024:16:34:53 /noindex/css/fonts/Bold/OpenSans-Bold.woff 192.168.1.55 238 [21/Sept/2024:16:34:52 /noindex/css/fonts/Bold/OpenSans-Bold.ttf 192.168.1.55 238 [21/Sept/2024:16:34:51 /noindex/css/fonts/Bold/OpenSans-Bold.ttf 192.168.1.5[root@master ~]# cat /etc/httpd/logs/access_log |awk '($10>=1000 && $7~/css/){print $10" "$4" "$7" "$1}'|sort -n|uniq -c|sort -rn|head -101 5081 [21/Sept/2024:16:47:08 /noindex/css/open-sans.css 192.168.1.41 5081 [21/Sept/2024:16:34:13 /noindex/css/open-sans.css 192.168.1.51 19341 [21/Sept/2024:16:47:08 /noindex/css/bootstrap.min.css 192.168.1.41 19341 [21/Sept/2024:16:34:13 /noindex/css/bootstrap.min.css 192.168.1.5
大于等于1k
#简单统计流量[root@master ~]# cat /etc/httpd/logs/access_log |awk '{sum+=$10}'
#统计401访问拒绝的数量[root@master ~]# cat /etc/httpd/logs/access_log |awk '(/401/)'|wc -l[root@master ~]# cat /etc/httpd/logs/access_log |awk '{print $9}'|sort|uniq -c|sort -rn
#查看某一时间的IP连接数[root@master ~]# grep "2020:16:47" /etc/httpd/logs/access_log |awk '{print $4}'|sort|uniq -c|sort -rn
错误日志分析
错误日志记录等级
原创 运维星火燎原
