I need to look for some requests in a huge pile of apache logs. My only requirement is this:
I need to only view the requests coming from any IP address that is NOT included in a list of 50 IP ranges I have.
How can I make that happen using any combination of regexes awk grep or anything? Can't think of an easy way. The idea would be to get each line, get the first part (the IP address), match it to a file with all the ranges, and if its not there, then display it. No idea on how to go about doing this, so any help is welcome!
a Typical http log line is
123.456.789.012 - - [22/Oct/2012:06:37:48 +0100] "GET /test/test HTTP/1.1" 302 224 "-" "some user agent/4.3.5"
A typical line out of my IP ranges file is
192.168.0.1 - 192.168.0.255
Of cours ethe IP ranges file could be converted to 192.168.0.1/24 notation if necessary. The good thing is that all the ranges are Class C (just noticed that), so I guess only the first 3 parts of the IP address could be matched and that should be good enough.