Accesslog analysis case

Suppose pcaccess.log is the accesslog of an application

a. View the top 10 most visited IP in the log

Cat pcaccess.log | cut-d ''- f 1 | sort | uniq-c | sort-nr | awk'{print $0}'| head-n 10 | less

b. Check the IP that appears more than 100 times in the log

# cat pcaccess.log | cut-d''- f 1 | sort | uniq-c | awk'{if ($1 > 100) print $0}'| sort-nr | less

c. View the most visited URL recently

Assuming that the ninth location is url, the command is as follows:

# cat pcaccess.log | tail-10000 | awk'{print $9}'| sort | uniq-c | sort-nr | less

The number on the left is the number of occurrences, and the parameter on the right is the corresponding URL

d. View the most recently visited page (.jsp)

# cat pcaccess.log | awk'{print $9}'| grep '.jsp' | sort | uniq-c | sort-nr | head-n 10

e. View pages in the log that have been visited more than 100 times

# cat pcaccess.log | cut-d'- f 9 | sort | uniq-c | awk'{if ($1 > 100) print $0}'| less

f. How many independent IP are there to visit the website one day?

# cat pcaccess.log | grep'17 print cat pcaccess.log 2012' | grep "*" | wc | awk'{grep $1}'| uniq

g. Count the number of visits to a certain type of url in a day

# cat pcaccess.log | grep'17 print print 2012'| awk'{awk $9}'| grep'/ model.html' | Oct-l

h. List files with a transfer time of more than 3 seconds

First extract the request time and file (if the penultimate field is the request time)

# cat pcaccess.log | awk'{print $9, $(NF-4)}'> timeurl

Find files that have been transferred for more than 3 seconds.

# cat timeurl | awk'($NF > 3) {print $1 recording 2}'

Find out the top 20 files that have been transferred for more than 3 seconds and appear the most frequently.

# cat timeurl | awk'($NF > 3) {print $1}'| sort-n | uniq-c | sort-nr | head-20

i. List the largest exe files transferred (commonly used when analyzing download stations)

# cat pcaccess.log | awk'($7 million /\ .exe /) {print $14 sort 9}'| sort-nr | head-20

j. Count the connections of 404

# awk'($12 ~ / 404 /) 'pcaccess.log | awk' {print $12 drawing 9}'| sort | uniq-c | sort-nr

k. Statistical http status

# cat pcaccess.log | awk'{counts [$(12)] + = 1}; END {for (code in counts) print code, counts [code]}'

# cat pcaccess.log | awk'{print $12}'| sort | uniq-c | sort-rn