How to find IPs with highest count of requests in access.log

First command will show you IPs sorted by number and them count of requests:

cat access.log | awk '{print $1}' | sort | uniq -c

You will be able to find IP masks with highest count of requests:

...
    158 217.115.65.19
    152 217.115.92.114
   3236 217.118.64.107
   8631 217.118.64.115
    640 217.118.64.119
   5122 217.118.64.124
    980 217.118.64.14
     37 217.218.94.2
     41 217.218.164.34
...

Next command will show you IPs sorted by count of requests:

less access.log | cut -d' ' -f1 | sort | uniq -c | sort -bg

For example:

...
   3818 178.207.194.252
   4090 89.169.172.165
   4732 60.47.208.104
   6500 82.146.33.201
   6698 31.200.239.18
   9934 141.8.132.20
  18032 141.8.142.126
...
 45   2 mon  
Popular