On Fri, Apr 03, 2009 at 11:50:46AM +0100, Tom Brown wrote:

I need to find out how many times an IP address appears in a file - the IP is the first field in the access log string so what would be the best way to sort this file and count how many times each IP address appears ?

Depends on what the seperator is between the columns. If it's a space (as with httpd logs) then cut -d' ' -f1 FILE | sort | uniq -c | sort -n

I need to find out how many times an IP address appears in a file - the IP is the first field in the access log string so what would be the best way to sort this file and count how many times each IP address appears ?

I always solve a problem like this with a small Perl script. It can probably be done in awk as well, but I prefer Perl. Try something like this:

=============== cut here =============== #!/usr/bin/perl use warnings; use strict;

my $log = shift || "/var/log/httpd/access_log"; my %hash;

open(LOG, $log) || die "Can't open $log for reading ($!)\n"; while(<LOG>) { next unless (/(^\d+.\d+.\d+.\d+)/); $hash{$1}++; } close(LOG);

foreach (sort keys %hash) { printf "%15s: %d occurances\n", $_, $hash{$_}; } exit(0); =============== cut here ===============

The script looks in either the file passed as the first parameter, or in the absence of that in /var/log/httpd/access_log.

Alfred