Extract and Count Unique IP Addresses from Nginx Logs

Extract unique IP addresses from Nginx access.log file and sort IP addresses based on HTTP requests count. Useful to identify bad IP addresses that flood or DDoS a website.

Get all IP addresses from Nginx access.log:

cat access.log | awk '{print $1}'

Get only unique IP addresses:

cat access.log | awk '{print $1}' | sort | uniq

Get only unique IP addresses and count them:

cat access.log | awk '{print $1}' | sort | uniq -c | sort -nr

Another command is this:

cat access.log | cut -f1 -d ' ' | sort | uniq -c | sort -nr

Example output:

412 66.249.89.XXX
371 66.249.89.XXX
361 66.249.89.XXX
344 31.59.82.XXX
129 85.15.0.XXX
 70 151.237.238.XXX
 48 66.249.92.XXX
 42 212.114.111.XXX
 42 212.114.110.XXX
 36 212.114.111.XXX
 31 95.108.158.XXX
 30 68.180.228.XXX
 29 46.148.99.XXX
 28 95.226.111.XXX
 26 68.180.229.XXX

More Related Posts