Linux 一条命令统计 Nginx 访问IP

访问日志示例

192.xxx.xxx.xxx - - [17/04/2020:02:58:45 +0000] "GET / HTTP/1.1" 502 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0"
10.xxx.xxx.xxx - - [17/04/2020:02:58:45 +0000] "GET / HTTP/1.1" 502 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0"
43.xxx.xxx.xxx - - [17/04/2020:02:58:45 +0000] "GET / HTTP/1.1" 502 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0"

统计命令

提取访问IP

cat access.log |awk '{print$1}'

21.39.167.131
122.117.57.136
22.203.185.65
172.50.45.66
40.59.251.60
182.252.87.138
82.98.164.250
117.125.39.35
244.33.172.7
231.226.157.103
...

统计IP访问次数

cat access.log |awk '{print1}'|sort|uniq -c

10 236.11.168.37
22 17.230.208.37
3 139.46.101.227
1 239.116.73.255
1 124.60.114.227
1 255.21.72.166
70 83.217.204.84
121 251.133.40.224
32 183.75.222.91
102 30.143.157.245
...

根据访问次数倒序显示

cat access.log | awk '{print$1}' |sort|uniq -c|sort -rn

334 182.138.158.183
250 182.138.158.67
158 182.138.158.156
84 182.138.137.127
16 36.32.3.46
10 123.245.24.149
8 163.177.13.2
7 182.96.12.70
6 39.100.240.14
6 39.100.231.247
...

提取访问量前5的IP及访问次数

cat access.log | awk '{print$1}' |sort|uniq -c|sort -rn|head -5

334 182.138.158.183
250 182.138.158.67
158 182.138.158.156
84 182.138.137.127
16 36.32.3.46