Find Top 10 IP Addresses Accessing Your Apache Web Server

The default path for Apache web server log is:

/var/log/http/access_log      [For RedHat based systems]
/var/log/apache2/access.log   [For Debian based systems]
/var/log/http-access.log      [For FreeBSD]

To find out top 10 IP address accessing your Apache web server for domain, just run the following command.

# awk '{ print $1}' access.log.2016-05-08 | sort | uniq -c | sort -nr | head -n 10

Sample Output

5482 103.28.37.178
5356 66.249.78.168
1977 66.249.93.145
1962 157.55.39.251
1924 66.249.93.142
1921 66.249.93.148
1890 64.233.173.178
1860 108.61.183.134
1841 64.233.173.182
1582 157.55.39.251

In the command above:

1. awk – prints the access.log.2016-05-08 file.
2. sort – helps to sort lines in a access.log.2016-05-08 file, the -n option compares lines based on the numerical value of strings and -r option reverses the outcome of the comparisons.
3. uniq – helps to report repeated lines and the -c option helps to prefix lines according to the number of occurrences.