查找IP地址

ding_cw

nginx日志error  

27929:2014/08/11 11:31:49 [error] 4891#0: *87415619 limiting connections by zone "addr", client: 220.181.165.136, server: www.XXXX.com, request: "GET /css/hao/a.php HTTP/1.1", host: "www.XXXX.com"

14843:2014/08/11 11:20:48 [warn] 4890#0: *87384649 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/7/98/0000095987 w
hile reading upstream, client: 220.181.165.133, server: www.XXXX.com, request: "GET /site/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "www.
XXXX.com"

使用这种方式查找IP，有的查找不正确

awk '{print $1,$11}' error.log | more

2963:2014/08/11 220.181.165.193,
2964:2014/08/11 220.181.165.9,
2965:2014/08/11 220.181.165.137,
14533:2014/08/11 to
14572:2014/08/11 to
14657:2014/08/11 forbidden,
14693:2014/08/11 forbidden,
14694:2014/08/11 forbidden,

观察了一下，貌似IP地址都在client:后面，能以client：为关键字，查找它后面的IP地址吗？

yestreenstars

不要贴图片

jason680

回复 1# ding_cw

$ awk 'match($0,"client: ([^ ]+)",a){print $1,a[1]}' FILE
   

Buring__

grep -oP '(?<=client: )[^,]+'

Linux_JinYuan

别贴图片，贴文本。。

ding_cw

回复 3# jason680

1.     awk 'match($0,"client:([^ ]+)",a){print $1,a[1]}' error.log

复制代码

没有任何结果输出啊

ding_cw

回复 4# Buring__

1.     grep -oP '(?<=client: )[^,]+' error.log

复制代码

可以实现  谢谢！

Buring__

回复 7# ding_cw


    提问题要发文本，表图片，不然，大神们都懒得回答的，菜鸟回答的你就随便参考下

jason680

回复 6# ding_cw

you lose a space in your code
   

q1208c

回复 6# ding_cw
client: 后面有个空格.