统计分析日志

Posted 2020-10-07

已知 nginx 访问的日志文件在 /usr/local/nginx/logs/access.log 内，请统计下早上 10 点到 12 点来访 ip 最多的是哪个?

日志样例：

111.199.186.68 - [15/Sep/2017:09:58:37 +0800]  "//plugin.php?id=security:job" 200 "POST //plugin.php?id=security:job HTTP/1.1""http://a.lishiming.net/forum.php?mod=viewthread&tid=11338&extra=page%3D1%26filter%3Dauthor%26orderby%3Ddateline" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (Khtml, like Gecko) Chrome/61.0.3141.7 Safari/537.36" "0.516"

203.208.60.208 - [15/Sep/2017:09:58:46 +0800] "/misc.php?mod=patch&action=ipnotice&_r=0.05560809863330207&inajax=1&ajaxtarget=ip_notice" 200 "GET /misc.php?mod=patch&action=ipnotice&_r=0.05560809863330207&inajax=1&ajaxtarget=ip_notice HTTP/1.1""http://a.lishiming.net/forum.php?mod=forumdisplay&fid=65&filter=author&orderby=dateline" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3141.7 Safari/537.36" "0.065"

grep ‘15/Sep/2017:1[0-2]:[0-5][0-9]:‘ /usr/local/nginx/logs/access.log|awk ‘{print $1}‘|sort -n|uniq -c |tail -n1