Quick tip: Extract all unique IP addresses from Apache logs

March 30, 2011

Say you wanted to count the number of unique IP addresses hitting your Apache server. It’s very easy to do in a Linux (or compatible) shell.

First locate the log file for your site. The generic log is generally at /var/log/httpd/access_log or /var/log/apache2/access_log (depending on your distro). For virtualhost-specific logs, check the conf files or (if you have one active site and others in the background) run ls -alt /var/log/httpd to see which file is most recently updated.

Then spit out one line to see the format: tail -n1 /var/log/httpd/access_log

Find the IP address in that line and count which part it is. In this example it’s the 1st part (hence $1):

cat /var/log/httpd/access_log | awk ‘{print $1}’ | sort | uniq > /var/log/httpd/unique-ips.log

You’ll now have a list of sorted, unique IP addresses. To figure out the time range, run head -n1 /var/log/httpd/access_log to see the start point (and the tail) syntax above for the end point.)

To count the number of IPs: cat /var/log/httpd/unique-ips.log | wc -l

To paginate: more /var/log/httpd/unique-ips.log

Have fun.