我想找到IP地址和用户代理,已经作出了超过10个服务器请求每秒。请帮助我。我怎么做呢?也许与awk,grep?
以下是我的访问日志中的典型行:
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/datchik-temperatury-v-korpuse-pechki-honda-cr-v-200-pr-1019 HTTP/1.0" 200 387654 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/datchik-temperatury-v-salone-honda-cr-v-2002-2006-pr-1018 HTTP/1.0" 200 387484 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/datchik-temperatury-naruzhnogo-vozduha-defekt-honda-pr-12550 HTTP/1.0" 200 387484 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/klapan-otopitelya-benzin-honda-cr-v-2002-2006-797-pr-1006 HTTP/1.0" 200 387449 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/kronshtejn-radiatora-kondicionera-pravyj-honda-cr-pr-1008 HTTP/1.0" 200 387996 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/provodka-pechki-honda-cr-v-2-2002-2006-pr-12228 HTTP/1.0" 200 386676 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/datchik-temperatury-v-korpuse-pechki-honda-cr-v-200-pr-1019 HTTP/1.0" 200 387654 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/datchik-temperatury-v-salone-honda-cr-v-2002-2006-pr-1018 HTTP/1.0" 200 387484 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/datchik-temperatury-naruzhnogo-vozduha-defekt-honda-pr-12550 HTTP/1.0" 200 387484 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/klapan-otopitelya-benzin-honda-cr-v-2002-2006-797-pr-1006 HTTP/1.0" 200 387449 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/kronshtejn-radiatora-kondicionera-pravyj-honda-cr-pr-1008 HTTP/1.0" 200 387996 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/provodka-pechki-honda-cr-v-2-2002-2006-pr-12228 HTTP/1.0" 200 386676 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:51 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/rozshiryuvalnij-klapan-kondicionera-honda-cr-v-2-2-pr-11867 HTTP/1.0" 200 387227 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:26:55 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-obogreva-i-klimata-54/servoprivod-zaslonki-pechki-pravyj1-honda-cr-v-200-pr-1001 HTTP/1.0" 200 387750 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:24:41 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-bezopasnosti-52/datchik-udara-77970s9ab812m1-honda-cr-v-2-2002-2006-pr-12578 HTTP/1.0" 200 386162 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:24:45 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-bezopasnosti-52/datchik-udara-77970s9ac812m1-honda-cr-v-2-2002-200-pr-12577 HTTP/1.0" 200 386159 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:24:53 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-bezopasnosti-52/datchik-udara-77970scag911m1-honda-cr-v-2-2002-2006-pr-12575 HTTP/1.0" 200 386141 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:25:00 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-bezopasnosti-52/datchik-udara-perednij-levyj-77940s9an810-honda-cr-pr-12557 HTTP/1.0" 200 386548 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
95.216.137.119 - - [28/Jan/2023:03:25:06 +0200] "POST /index.php?route=api/login HTTP/1.0" 200 190 "-" "-"
95.216.137.119 - - [28/Jan/2023:03:25:07 +0200] "GET /index.php?route=api/oneboxsync/getOrderValue/&token=95ghttSKDUuykyhc4fY4tcDCuAmpZxrQ&api_token= HTTP/1.0" 200 216719 "-" "-"
176.9.50.244 - - [28/Jan/2023:03:25:09 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-bezopasnosti-52/datchik-udara-perednij-levyj-honda-cr-v-2002-2006-pr-992 HTTP/1.0" 200 386813 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
176.9.50.244 - - [28/Jan/2023:03:25:14 +0200] "GET /honda-1/honda-cr-v-2-2002-2006-12/sistema-bezopasnosti-52/datchik-udara-perednij-pravyj-77930s9an810-honda-cr-pr-12574 HTTP/1.0" 200 386777 "-" "Mozilla/5.0 (compatible; MegaIndex.ru/2.0; +http://megaindex.com/crawler)"
查找有关UA的信息,我运行这个:(给我每个唯一UA的点击量)
awk -F\" '{print $6}' /www/logs/www.example.com-access.log | sort | uniq -c | sort -fr
要使这些命令仅显示每秒发出10个以上请求的IP,我可以做些什么不同的操作?
如果有一些IP向服务器发出了10个或更多请求,我希望在日志中找到它。https://prnt.sc/1zKKp6tXx0UZ-这是来自同一IP(176.9.50.244)的每秒10个请求,因此可以使用命令捕获它并打印到屏幕
在这种情况下(对应于新的输入数据集),输出必须如下所示-必须仅打印一个IP
176.9.50.244
当计算每秒的请求数时,它必须计算具有相同时间戳和相同IP的所有行。让我们忘记UA,并尝试将重点放在IP上。我使用UA仅用于附加信息。
2条答案
按热度按时间qyuhtwio1#
有很多方法可以做到这一点。一个是下面。请标记为正确或添加评论,我会进一步解决这个问题。
fafcakar2#
一个
awk
创意:向输入文件添加一些变体:
对于
limit=10
,这将生成:对于
limit=4
,这将生成:对于
limit=2
,这将生成:176.9.50.244
出现两次;从OP的描述中还不清楚,我们是否应该在最终输出中只显示一次ip,或者为匹配标准的每个唯一时间戳集显示一次sort
,或者添加代码以使awk
在打印到stdout之前对数据进行排序