apache日志分析问题

zhaobin81

124.115.0.138 - - [06/Jul/2009:11:06:56 +0800] "GET /plus/feedback.php?arcID=10704 HTTP/1.1" 200 4727 "http://www.ccidcom.com/plus/feedback.php?arcID=10704" "Sosospider+(+http://help.soso.com/webspider.htm)"
65.55.232.49 - - [06/Jul/2009:11:06:57 +0800] "GET /include/dedeajax2.js HTTP/1.0" 200 6027 "http://www.ccidcom.com/" "Mozilla/4.0 (compatible;  MSIE 6.0;  Windows NT 5.1;  SLCC1;  .NET CLR 1.1.4322;  .NET CLR 2.0.50727;  .NET CLR 3.0.30729;  .NET CLR 3.5.30729;  InfoPath.2)"
202.160.180.94 - - [06/Jul/2009:11:06:58 +0800] "GET /bbs/space.php?action=viewpro&uid=9503 HTTP/1.0" 200 7758 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)"
202.160.180.154 - - [06/Jul/2009:11:06:58 +0800] "GET /bbs/viewthread.php?tid=9045&page=1 HTTP/1.0" 200 25511 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)"
202.160.181.139 - - [06/Jul/2009:11:06:58 +0800] "GET /blog/?uid-11893-action-viewspace-itemid-36888 HTTP/1.0" 200 7507 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)"
117.25.173.10 - - [06/Jul/2009:11:06:58 +0800] "GET /blog/attachments/2009/06/11576_200906220049321.jpg HTTP/1.1" 200 32095 "http://www.hillroad.cn/?uid-113199-action-viewspace-itemid-6475" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB6; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727; CIBA)"
117.25.173.10 - - [06/Jul/2009:11:06:58 +0800] "GET /blog/attachments/2009/06/11576_200906220049391.jpg HTTP/1.1" 200 19633 "http://www.hillroad.cn/?uid-113199-action-viewspace-itemid-6475" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB6; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727; CIBA)"
203.208.60.7 - - [06/Jul/2009:11:06:59 +0800] "GET /bbs//viewthread.php?tid=36443&page=1 HTTP/1.1" 200 19271 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
202.160.189.225 - - [06/Jul/2009:11:06:59 +0800] "GET /bbs/ HTTP/1.0" 200 25812 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)"
219.141.211.94 - - [06/Jul/2009:11:06:50 +0800] "GET /uploads/litimg/090610/11360496117.gif HTTP/1.1" 200 41269 "http://www.ccidcom.com/html/xinwenfenlei/tongxinhuizhanzhuye/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)"

如何配置出一个时间段里那个ip的访问量最大并打印出访问次数！
给个思路！
谢谢！

rdcwayx

ding

[ 本帖最后由 rdcwayx 于 2009-7-6 21:05 编辑 ]

zhaobin81

[root@ccidcom logs]# awk -F'[ [/]''/\[06/Jul/2009:11:1[0-9]/{a[$1,$5"/"$6"/"$7" "$8":"$9":"$10]++}END{for(i in a)print i,a}' ip-access_log >test.log
awk: warning: escape sequence `\[' treated as plain `['

自己写了一个可是报错！
黑哥帮忙看看！

kwokcn

所谓的“时间段”指什么？
以秒为单位：

1. 
   
2. awk -F"[ []" '{a[$1" "$5]++}END{for(i in a) print i,a[i]}' URFILE | sort -k3nr
   

复制代码

以分、小时、天、月等等为单位，结合gsub处理一下$5即可。

blackold

先搞清楚时间段吧。

lucash

1. sed 's/\[\|:[0-9][0-9] /  /g' log | awk '{++S[$4"\t"$1]}END{for (i in S) print i"\t次数"S[i]}'

复制代码

[ 本帖最后由 lucash 于 2009-7-6 14:41 编辑 ]

lucash

1. awk '{gsub(":[0-9][0-9]$","  ",$4);++S[$4"\t"$1]}END{for (i in S) print i"\t次数"S[i]}'  log

复制代码

[ 本帖最后由 lucash 于 2009-7-6 14:41 编辑 ]