下面是我截取一段nginx日志
127.0.0.1 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
127.0.0.1 - - [/Jan/::: +] "GET /favicon.ico HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
127.0.0.1 - - [/Jan/::: +] "GET /index.php HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
127.0.0.1 - - [/Jan/::: +] "GET /index.html HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
127.0.0.1 - - [/Jan/::: +] "GET /index.html HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
127.0.0.1 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET /favicon.ico HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET /favicon.ico HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
192.168.60.200 - - [/Jan/::: +] "GET / HTTP/1.1" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0"
方法一:
awk '{++S[$1]} END {for(a in S) print a,S[a]}' nginx.log | sort -rn -k
192.168.60.200
127.0.0.1
方法二:
awk '{print $1}' nginx.log|sort|uniq -c|sort -nr -k1
192.168.60.200
127.0.0.1
方法三:
sed 's/- -.*$//g' nginx.log|sort|uniq -c|sort -nr -k1
192.168.60.200
127.0.0.1
参考:http://oldboy.blog.51cto.com/2561410/1184206
http://oldboy.blog.51cto.com/blog/2561410/1184177