(转)shell查看apacheIP访问量

1.查看TCP连接状态



netstat -nat |awk &＃39;{print $6}&＃39;|sort|uniq -c|sort -rn



netstat -n | awk &＃39;/^tcp/ {&＃43;&＃43;S[$NF]};END {for(a in S) print a, S[a]}&＃39;



netstat -n | awk &＃39;/^tcp/ {&＃43;&＃43;state[$NF]}; END {for(key in state) print key,"\t",state[key]}&＃39;



netstat -n | awk &＃39;/^tcp/ {&＃43;&＃43;arr[$NF]};END {for(k in arr) print k,"\t",arr[k]}&＃39;



netstat -n |awk &＃39;/^tcp/ {print $NF}&＃39;|sort|uniq -c|sort -rn



netstat -ant | awk &＃39;{print $NF}&＃39; | grep -v &＃39;[a-z]&＃39; | sort | uniq -c



netstat -ant|awk &＃39;/ip:80/{split($5,ip,":");&＃43;&＃43;S[ip[1]]}END{for (a in S) print S[a],a}&＃39; |sort -n



netstat -ant|awk &＃39;/:80/{split($5,ip,":");&＃43;&＃43;S[ip[1]]}END{for (a in S) print S[a],a}&＃39; |sort -rn|head -n 10



awk &＃39;BEGIN{printf ("http_code\tcount_num\n")}{COUNT[$10]&＃43;&＃43;}END{for (a in COUNT) printf a"\t\t"COUNT[a]"\n"}&＃39;



2.查找请求数请20个IP&＃xff08;常用于查找攻来源&＃xff09;&＃xff1a;



netstat -anlp|grep 80|grep tcp|awk &＃39;{print $5}&＃39;|awk -F: &＃39;{print $1}&＃39;|sort|uniq -c|sort -nr|head -n20



netstat -ant |awk &＃39;/:80/{split($5,ip,":");&＃43;&＃43;A[ip[1]]}END{for(i in A) print A[i],i}&＃39; |sort -rn|head -n20



3.用tcpdump嗅探80端口的访问看看谁最高



tcpdump -i eth0 -tnn dst port 80 -c 1000 | awk -F"." &＃39;{print $1"."$2"."$3"."$4}&＃39; | sort | uniq -c | sort -nr |head -20



4.查找较多time_wait连接



netstat -n|grep TIME_WAIT|awk &＃39;{print $5}&＃39;|sort|uniq -c|sort -rn|head -n20



5.找查较多的SYN连接



netstat -an | grep SYN | awk &＃39;{print $5}&＃39; | awk -F: &＃39;{print $1}&＃39; | sort | uniq -c | sort -nr | more



6.根据端口列进程



netstat -ntlp | grep 80 | awk &＃39;{print $7}&＃39; | cut -d/ -f1



网站日志分析&＃xff08;Apache&＃xff09;&＃xff1a;

1.获得访问前10位的ip地址



cat access.log|awk &＃39;{print $1}&＃39;|sort|uniq -c|sort -nr|head -10



cat access.log|awk &＃39;{counts[$(11)]&＃43;&＃61;1}; END {for(url in counts) print counts[url], url}&＃39;



2.访问次数最多的文件或页面,取前20及统计所有访问IP



cat access.log|awk &＃39;{print $11}&＃39;|sort|uniq -c|sort -nr|head -20



awk &＃39;{ print $1}&＃39; access.log |sort -n -r |uniq -c|wc -l



3.列出传输最大的几个exe文件&＃xff08;分析下载站的时候常用&＃xff09;



cat access.log |awk &＃39;($7~/\.exe/){print $10 " " $1 " " $4 " " $7}&＃39;|sort -nr|head -20



4.列出输出大于200000byte(约200kb)的exe文件以及对应文件发生次数



cat access.log |awk &＃39;($10 > 200000 && $7~/\.exe/){print $7}&＃39;|sort -n|uniq -c|sort -nr|head -100



5.如果日志最后一列记录的是页面文件传输时间&＃xff0c;则有列出到客户端最耗时的页面



cat access.log |awk &＃39;($7~/\.php/){print $NF " " $1 " " $4 " " $7}&＃39;|sort -nr|head -100



6.列出最最耗时的页面(超过60秒的)的以及对应页面发生次数



cat access.log |awk &＃39;($NF > 60 && $7~/\.php/){print $7}&＃39;|sort -n|uniq -c|sort -nr|head -100



7.列出传输时间超过 30 秒的文件



cat access.log |awk &＃39;($NF > 30){print $7}&＃39;|sort -n|uniq -c|sort -nr|head -20



8.统计网站流量&＃xff08;G)



cat access.log |awk &＃39;{sum&＃43;&＃61;$10} END {print sum/1024/1024/1024}&＃39;



9.统计404的连接



awk &＃39;($9 ~/404/)&＃39; access.log | awk &＃39;{print $9,$7}&＃39; | sort



10. 统计http status.



cat access.log |awk &＃39;{counts[$(9)]&＃43;&＃61;1}; END {for(code in counts) print code, counts[code]}&＃39;



cat access.log |awk &＃39;{print $9}&＃39;|sort|uniq -c|sort -rn



11.每秒并发&＃xff1a;



awk &＃39;{if($9~/200|30|404/)COUNT[$4]&＃43;&＃43;}END{for( a in COUNT) print a,COUNT[a]}&＃39;|sort -k 2 -nr|head -n10



12.带宽统计



cat apache.log |awk &＃39;{if($7~/GET/) count&＃43;&＃43;}END{print "client_request&＃61;"count}&＃39;



cat apache.log |awk &＃39;{BYTE&＃43;&＃61;$11}END{print "client_kbyte_out&＃61;"BYTE/1024"KB"}&＃39;



13.统计对象数量及对象平均大小



cat access.log |awk &＃39;{byte&＃43;&＃61;$10}END{ print byte/NR/1024,NR}&＃39;



cat access.log |awk &＃39;{if($9~/200|30/)COUNT[$NF]&＃43;&＃43;}END{for( a in COUNT) print a,COUNT



[a],NR,COUNT[a]/NR*100"%"}



14.取5分钟日志



if [ $DATE_MINUTE !&＃61; $DATE_END_MINUTE ] ;then #则判断开始时间戳与结束时间戳是否相等START_LINE&＃61;&＃96;sed -n "/$DATE_MINUTE/&＃61;" $APACHE_LOG|head -n1&＃96; #如果不相等&＃xff0c;则取出开始时间戳的行号&＃xff0c;与结束时间戳的行号



#END_LINE&＃61;&＃96;sed -n "/$DATE_END_MINUTE/&＃61;" $APACHE_LOG|tail -n1&＃96;



END_LINE&＃61;&＃96;sed -n "/$DATE_END_MINUTE/&＃61;" $APACHE_LOG|head -n1&＃96;sed -n "${START_LINE},${END_LINE}p" $APACHE_LOG > $MINUTE_LOG ##通过行号&＃xff0c;取出5分钟内的日志内容 存放到 临时文件中



GET_START_TIME&＃61;&＃96;sed -n "${START_LINE}p" $APACHE_LOG|awk -F &＃39;[&＃39; &＃39;{print $2}&＃39; |awk &＃39;{print $1}&＃39;|



sed &＃39;s#/# #g&＃39;|sed &＃39;s#:# #&＃39;&＃96; #通过行号获取取出开始时间戳



GET_END_TIME&＃61;&＃96;sed -n "${END_LINE}p" $APACHE_LOG|awk -F &＃39;[&＃39; &＃39;{print $2}&＃39; |awk &＃39;{print $1}&＃39;|sed



&＃39;s#/# #g&＃39;|sed &＃39;s#:# #&＃39;&＃96; #通过行号获取结束时间戳



15.蜘蛛分析



查看是哪些蜘蛛在抓取内容



/usr/sbin/tcpdump -i eth0 -l -s 0 -w - dst port 80 | strings | grep -i user-agent | grep -i -E &＃39;bot|crawler|slurp|spider&＃39;



网站日分析2(Squid篇&＃xff09;



2.按域统计流量



zcat squid_access.log.tar.gz| awk &＃39;{print $10,$7}&＃39; |awk &＃39;BEGIN{FS&＃61;"[ /]"}{trfc[$4]&＃43;&＃61;$1}END{for



(domain in trfc){printf "%s\t%d\n",domain,trfc[domain]}}&＃39;



效率更高的perl版本请到此下载:http://docs.linuxtone.org/soft/tools/tr.pl



数据库篇



1.查看数据库执行的sql



/usr/sbin/tcpdump -i eth0 -s 0 -l -w - dst port 3306 | strings | egrep -i &＃39;SELECT|UPDATE|DELETE|INSERT|SET|COMMIT|ROLLBACK|CREATE|DROP|ALTER|CALL&＃39;



系统Debug分析篇



1.调试命令



strace -p pid



2.跟踪指定进程的PID



gdb -p pid