Parsing Web Server Logs

This is assuming your webserver log is access.log.

Extract unique IP addresses from the webserver log:

cat access.log | awk '{print $1}' | uniq

Count number of unique IP addresses from log:

cat access.log | awk '{print $1}' | uniq | wc -l

List the IP addresses of users using iPhones:

cat access.log | grep -i iphone | awk '{print $1}' | uniq | sort

Count number of IP addresses of visitors who have a 444 error:

grep '444 0' access.log | awk '{print $1}' | sort -n | uniq -c | sort -n

List and sort user-agent strings uniquely:

awk -F"\"" '{print $6}' access.log | sort | uniq -dc | sort -nr

List top 25 IP addresses that have accessed my website:

awk '{print $1}' access.log | sort -n | uniq -c | sort -n | tail -25

Last Update: 02 January 2017 [Created on 01 June 2009]

Affiliate Disclosure: Some of the links to products on this blog are affiliate links. It simply means, at no additional cost to you, we’ll earn a commission if you click through and buy any product.