shell Nginx Apache日誌分析指令碼

1,檢視apache程序:

2,檢視80埠的tcp連線:

netstat -tan | grep "established" | grep ":80" | wc -l

3,通過日誌檢視當天ip連線數，過濾重複:

cat access_log | grep "20/oct/2008" | awk '' | sort | uniq -c | sort -nr

4,當天ip連線數最高的ip都在幹些什麼(原來是蜘蛛):

cat access_log | grep "20/oct/2008:00" | grep "122.102.7.212" | awk '' | sort | uniq -c | sort -nr | head -n 10

5,當天訪問頁面排前10的url:

cat access_log | grep "20/oct/2008:00" | awk '' | sort | uniq -c | sort -nr | head -n 10

6,用tcpdump嗅探80埠的訪問看看誰最高

tcpdump -i eth0 -tnn dst port 80 -c 1000 | awk -f"." '' | sort | uniq -c | sort -nr

接著從日誌裡檢視該ip在幹嘛:

cat access_log | grep 122.102.7.212| awk '' | sort | uniq -c | sort -nr | less

7,檢視某一時間段的ip連線數:

格式如下：

通過日誌檢視當天ip連線數，過濾重複

cat access.log | grep "20/mar/2011" | awk '' | sort | uniq -c | sort -nr

38 112.97.192.16

20 117.136.31.145

19 112.97.192.31

3 61.156.31.20

2 209.213.40.6

1 222.76.85.28

當天訪問頁面排前10的url:

cat access.log | grep "20/mar/2011" | awk '' | sort | uniq -c | sort -nr | head -n 10

找出訪問次數最多的10個ip

awk '' access.log |sort |uniq -c|sort -nr|head

10680 10.0.21.17

1702 10.0.20.167

823 10.0.20.51

504 10.0.20.255

215 58.60.188.61

192 183.17.161.216

38 112.97.192.16

20 117.136.31.145

19 112.97.192.31

6 113.106.88.10

找出某天訪問次數最多的10個ip

cat /tmp/access.log | grep "20/mar/2011" |awk ''|sort |uniq -c|sort -nr|head

38 112.97.192.16

20 117.136.31.145

19 112.97.192.31

3 61.156.31.20

2 209.213.40.6

1 222.76.85.28

當天ip連線數最高的ip都在幹些什麼: