0
184.13.80.102 - - [07/Jan/2019:00:33:10 -0500] "GET /?p=454 HTTP/1.1" 200 8822 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [07/Jan/2019:20:16:12 -0500] "GET /?p=454 HTTP/1.1" 200 8820 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
184.13.80.102 - - [07/Jan/2019:23:14:10 -0500] "GET /?p=454 HTTP/1.1" 200 8820 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [08/Jan/2019:02:32:22 -0500] "GET /?p=454 HTTP/1.1" 200 8819 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [08/Jan/2019:03:57:19 -0500] "GET /?p=454 HTTP/1.1" 200 8819 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [08/Jan/2019:23:05:32 -0500] "GET /?p=454 HTTP/1.1" 200 8819 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [09/Jan/2019:07:35:10 -0500] "GET /?p=454 HTTP/1.1" 200 8821 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [09/Jan/2019:14:45:36 -0500] "GET /?p=454 HTTP/1.1" 200 8819 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [09/Jan/2019:23:22:03 -0500] "GET /?p=454 HTTP/1.1" 200 8821 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [10/Jan/2019:23:50:28 -0500] "GET /?p=454 HTTP/1.1" 200 8819 "-" "Mozilla/5.0 (X11; Linux i686; rv:60.0) Gecko/20100101 Firefox/60.0"
184.13.80.102 - - [13/Jan/2019:00:56:36 -0500] "GET /?p=454 HTTP/1.1" 200 8821 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [15/Jan/2019:20:47:56 -0500] "GET /?p=454 HTTP/1.1" 200 8819 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:64.0) Gecko/20100101 Firefox/64.0"
184.13.80.102 - - [15/Jan/2019:22:36:09 -0500] "GET /?p=454 HTTP/1.1" 200 8821 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"

This user tries to flood my server. How can I use cat or awk to check access_log for a specific ip and detect how many days the ip tried to access the server?

It is 6 days in this example.

1

You can use the command:

grep "$ip" log_file | cut -d '[' -f2 | cut -d '/' -f1 | uniq | wc -l

Let us say the ip address to search is in the variable ip, and log_file is your log file.

You can define ip variable as ip="184.13.80.102".

1
#!/bin/bash
echo "enter the ip"
read ip
awk -v i="$i" '/i/{print $4}' filename| sed "s/\[//g"| awk '{print substr($1,1,2)}'|awk '{if (!seen[$1]++)print $1}'| wc -l| sed "1i Below are Number of times "$ip" exsists"

output
Below are Number of times 184.13.80.102 exsists
6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.