Script-fu

So, you want to turn a 14,000 line logfile with 9300 lines like the following, into a summary of the most often seen ip addresses?
Oct 23 01:04:36 nameserver.dept.uiuc.edu in.named[26133]: [ID 873579 local1.warning] client 192.168.0.4#52241: no more recursive clients: quota reached
Oct 23 01:04:36 nameserver.dept.uiuc.edu in.named[26133]: [ID 873579 local1.warning] client 192.168.0.5#52241: no more recursive clients: quota reached

Here’s your one-liner, showing just the top 10 hitters
cat /services/dns/log/named.20061023 | grep 'quota' | tr -s " " | cut -d " " -f 10 | perl -pi -e 's/(.*)#.*/$1/' | sort | uniq -c | sort -n | tail
and it’s output:
161 192.168.254.29
163 192.168.5.119
167 192.168.172.72
201 192.168.5.12
223 192.168.5.138
257 192.168.0.7
298 192.168.181.2
307 192.168.0.9
905 192.168.252.5
2630 192.168.252.4

Leave a Reply

Your email address will not be published. Required fields are marked *