Find Top 10 IP Addresses Accessing Your Apache Web Server

In this post, you will learn how to Find Top 10 IP Addresses Accessing Your Apache Web Server-

The monitoring access to your web server is the existence of access log files that store information about every access activities happen in the server.

Working with log files is always very important, because they give you an account of everything that has happened within a system or application in this case your Apache web server. In case of any performance or access related problems, then log files can help you point out what could be wrong or is happening.

In this article, we will show you how to find the top 10 addresses that accessing your apache web server.

Apache Access Logs

Apache server records all incoming requests and all requests processed to a log file. The format of the access log is highly configurable. The location and content of the access log are controlled by the CustomLog directive. Default apache access log file location:

• RHEL / Red Hat / CentOS / Fedora Linux Apache access file location – /var/log/httpd/access_log
• Debian / Ubuntu Linux Apache access log file location – /var/log/apache2/access.log
• FreeBSD Apache access log file location – /var/log/httpd-access.log

To find exact apache log file location, you can use grep command:

grep CustomLog /usr/local/etc/apache22/httpd.conf
grep CustomLog /etc/apache2/apache2.conf
grep CustomLog /etc/httpd/conf/httpd.conf

Sample output:

# a CustomLog directive (see below).
#CustomLog "/var/log/httpd-access.log" common
CustomLog "/var/log/httpd-access.log" combined

Apache Error Logs

Default error log file location:

• RHEL / Red Hat / CentOS / Fedora Linux Apache error file location – /var/log/httpd/error_log
• Debian / Ubuntu Linux Apache error log file location – /var/log/apache2/error.log
• FreeBSD Apache error log file location – /var/log/httpd-error.log

To find apache log file location, you can use grep command:

grep ErrorLog /usr/local/etc/apache2/httpd.conf
grep ErrorLog /etc/apache2/apache2.conf
grep ErrorLog /etc/httpd/conf/httpd.conf

Sample output:

# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a 
ErrorLog "/var/log/httpd-error.log"

 Find top 10 IP addresses accessing your Apache web server

Run this command using the manipulation tool awk

awk '{ print $1}' access.log-20201011 | sort | uniq -c | sort -nr | head -n 10

awk will print the access.log-20201011, the will be sorted as lines with sort, the -n option compares lines based on the numerical value of strings and -r option reverses the outcome of the comparisons.

uniq will help to report repeated lines and the -c option helps to prefix lines according to the number of occurrences.

Conclusion

That’s it ..

In this article, we illustrated how to find the apache access and error logs in addition to finding the top 10 addresses that accessing your apache web server.

website