Sort uniq IP address in from Apache log

Question

I\'m trying to extract IP addresses from my apache log, count them, and sort them.

And for whatever reason, the sorting part is horrible.

Here is the command

Answer 1

This should work

cat access.* | awk '{ print $1 }' | sort | awk '{print $1 " " $2;}' | sort -n

I can't see a problem.

Control characters in the files?

File system full (temp files)?

Answer 2

I don't know why a simple sort -n didn't work, but adding a non numeric character between the counter and the IP soved my issue.

cat access.* | awk '{ print $1 } ' | sort | uniq -c | sed -r 's/^[ \t]*([0-9]+) (.*)$/\1 --- \2/' | sort -rn

Answer 3

Why use cat | awk? You only need to use awk:

awk '{ print $1 }' /var/log/*access*log | sort -n | uniq -c | sort -nr | head -20

Answer 4

If sort isn't resulting as expected it's probably due to a locale issue.

| LC_ALL=C sort -rn

awk '{array[$1]++}END{ for (ip in array) print array[ip] " " ip}' <path/to/apache/*.log> | LC_ALL=C sort -rn

Sources sort not sorting as expected (space and locale)

https://www.commandlinefu.com/commands/view/9744/sort-ip-by-count-quickly-with-awk-from-apache-logs

Answer 5

This may be late, but using the numeric in the first sort will give you the desired result,

cat access.log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -20

Output:

 29877 93.xxx.xxx.xxx
  17538 80.xxx.xxx.xxx
   5895 198.xxx.xxx.xxx
   3042 37.xxx.xxx.xxx
   2956 208.xxx.xxx.xxx
   2613 94.xxx.xxx.xxx
   2572 89.xxx.xxx.xxx
   2268 94.xxx.xxx.xxx
   1896 89.xxx.xxx.xxx
   1584 46.xxx.xxx.xxx
   1402 208.xxx.xxx.xxx
   1273 93.xxx.xxx.xxx
   1054 208.xxx.xxx.xxx
    860 162.xxx.xxx.xxx
    830 208.xxx.xxx.xxx
    606 162.xxx.xxx.xxx
    545 94.xxx.xxx.xxx
    480 37.xxx.xxx.xxx
    446 162.xxx.xxx.xxx
    398 162.xxx.xxx.xxx