[Linux] access_log 분석[220.23.175.93]

www.domain.com $1  211.243.123.105$2 - - [24/Mar/2017:10:35:16$5 +0900]$6 "GET$7 /layout/header/default/image/header_img_01.png$8
 HTTP/1.1"$9(접속방식)  200$10(요청에대한 상태-403등등) 1103$11(용량) "https://gddfca.or.kr/index.php"$12접속 경로 "Mozilla/5.0$13 (compatible; MSIE 9.0; Windows$14 NT$15 6.1; WOW64; Trident/5.0; ; rv
 :11.0) like Gecko" KR$NF     <= $필드들은 좀 틀릴 수 있음. 

cat /usr/local/apache/logs/access_log | grep '\[07/Jul/2021' | awk '{print $2, $NF}' | sort -r  | uniq -c | sort -r  | head 

cat /usr/local/apache/logs/access_log-20201007 | grep '\[01/Sep' | awk '{print $2, $NF}'  | grep KR | wc -l 
cat /usr/local/apache/logs/access_log-20201007  | grep '\[01/Sep' |  grep -v KR  | wc -l 
cat /usr/local/apache/logs/access_log-20201007  | grep '\[01/Sep' | awk '{print $2, $NF}'    | wc -l 

cat /usr/local/apache/logs/access_log | grep '\[07/Jul//2021' | sed -n '/2021:10:00/,/2021:14:20/p' | awk '{print $2 , $NF}' | sort -r  | uniq -c | sort -r | head 

cat /usr/local/apache/logs/access_log | grep '\[07/Jul/2021' | sed -n '/2021:10:05/,/2020:10:13/p' | awk '{print $2, $12, $NF}' | sort -r  | uniq -c | sort -r | head

# 1.2.1 - sed 명령어 - 15시 00~05분까지의 시간 
sed -n  '/2021:15:00/,/2020:15:05/p' /usr/local/apache/logs/access_log | grep '\[07/Jul/2020'
# 1.2.2 위 명령어의 변형
cat /usr/local/apache/logs/access_log | sed -n '/2020:18:00/,/2020:18:05/p' > 00.txt
# 1.2.3
cat   /usr/local/apache/logs/access_log | grep '\[07/Jul/2021' | sed -n  '/2021:10:30/,/2021:14:00/p' | awk '{print  $2,  $NF}' | sort -r  | uniq -c | sort -r | head -20

# 1.3.1 정규식 활용  
tail -n 10 /usr/local/apache/logs/access_log | grep '\[01/Jul/2020:1[0-5]' <= [0~5까지의 숫자가 포함된 모든] 
# 1.3.2 cut 명령어 활용
tail -10000  /usr/local/apache/logs/access_log | grep '\[20/Jul/2020' | cut -d":" -f  2,3 | sort | uniq -c | sort -r
# 1.3.3 cut 명령어 활용 - 당일 하루 중 접속이 제일 많은 시간대를 구한다.  / -f 필드를 2만 한다면 당연히 하루 중 접속이 많은 시간대를 알수 있겠다.
cat /usr/local/apache/logs/access_log | grep '\[07/Jul/2021' | cut -d":" -f  2,3 | sort | uniq -c | sort -r | head

cat /usr/local/apache/logs/access_log | grep '\[19/Oct/2020' | cut -d":" -f  2 | sort | uniq -c | sort -r | head

cat   /usr/local/apache/logs/access_log | grep '\[07/Jun/2021' | sed -n   '/2021:13:00/,/2021:15:30/p' | awk '{print $1, $NF}' | sort -r  | uniq -c | sort -r | head -20

grep testdomain.com /usr/local/apache/logs/access_log | grep '\[24/May/2021' | sed -n   '/2021:13:00/,/2021:15:30/p' | awk '{print $1, $NF}' | sort -r  | uniq -c | sort -r | head -20

lsof -p 119164 | awk '{print $NF}' | sort -r | uniq -c | sort -r > mylog.txt