shell 习题54 分析日志

2020-02-10

已知nginx访问的日志文件在/usr/local/nginx/logs/access.log内，请统计下早上10点到12点来访ip最多的是哪个？

日志示例：

1
2

111.199.186.68 – [10/Feb/2020:10:58:37 +0800]  “//plugin.php?id=security:job” 200 “POST //plugin.php?id=security:job HTTP/1.1″”http://a.lishiming.net/forum.php?mod=viewthread&tid=11338&extra=page%3D1%26filter%3Dauthor%26orderby%3Ddateline” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3141.7 Safari/537.36”
203.208.60.208 – [10/Feb/2020:10:58:46 +0800] “/misc.php?mod=patch&action=ipnotice&_r=0.05560809863330207&inajax=1&ajaxtarget=ip_notice” 200 “GET /misc.php?mod=patch&action=ipnotice&_r=0.05560809863330207&inajax=1&ajaxtarget=ip_notice HTTP/1.1″”http://a.lishiming.net/forum.php?mod=forumdisplay&fid=65&filter=author&orderby=dateline” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3141.7 Safari/537.36”

核心要点

通过grep找出10点到12点之间的日志

$ egrep "`date +%d/%b/%Y:1[01]:[0-5][0-9]:`" aaa  #%b表示英语缩写月份 1[01]:[0-5][0-9]正则10:00-11:59

$ egrep "`date +%d/%b/%Y:1[01]:[0-5][0-9]:`" aaa|awk '{print $1}'
111.199.186.68
203.208.60.208
111.199.186.68
111.199.186.68

#sort -n 以数字从小到大排序
$ egrep "`date +%d/%b/%Y:1[01]:[0-5][0-9]:`" aaa|awk '{print $1}'|sort -n
111.199.186.68
111.199.186.68
111.199.186.68
203.208.60.208

$ egrep "`date +%d/%b/%Y:1[01]:[0-5][0-9]:`" aaa|awk '{print $1}'|sort -n|uniq -c
      3 111.199.186.68
      1 203.208.60.208

$ egrep "`date +%d/%b/%Y:1[01]:[0-5][0-9]:`" aaa|awk '{print $1}'|sort -n|uniq -c |sort -n
      1 203.208.60.208
      3 111.199.186.68

$ egrep "`date +%d/%b/%Y:1[01]:[0-5][0-9]:`" aaa|awk '{print $1}'|sort -n|uniq -c |sort -n|tail -1
      3 111.199.186.68

$ egrep "`date +%d/%b/%Y:1[01]:[0-5][0-9]:`" aaa|awk '{print $1}'|sort -n|uniq -c |sort -n|tail -1|awk '{print $2}'
111.199.186.68

代码内容

#!/bin/bash
#
#program:
#    统计下早上10点到12点来访ip最多的日志
#
#histroy:
#2020/02/10    kun    V1.0

export LANG=en
log="/usr/local/nginx/logs/access.log"
date=`date +%d/%b/%Y:1[01]:[0-5][0-9]:`

egrep "$date" $log |awk '{print $1}' |sort -n |uniq -c |sort -n |tail -1 |awk '{print $2}'