차이
문서의 선택한 두 판 사이의 차이를 보여줍니다.
다음 판 | 이전 판 | ||
apache_httpd_로그_분석 [2021/12/14 03:25] – 만듦 koov | apache_httpd_로그_분석 [2021/12/14 04:29] (현재) – koov | ||
---|---|---|---|
줄 28: | 줄 28: | ||
402 05:00 | 402 05:00 | ||
522 06:00 | 522 06:00 | ||
- | 456 07:00 | + | </ |
- | 490 08:00 | + | </ |
- | 438 09:00 | + | |
- | 430 10:00 | + | <WRAP prewrap> |
- | 357 11:00 | + | <code bash> |
- | 284 12:00 | + | [root@localhost ~]# awk -F" |
- | 391 13:00 | + | 172 2021-Dec-13 00 |
- | 163 14:00 | + | 158 2021-Dec-13 01 |
+ | 109 2021-Dec-13 02 | ||
+ | 142 2021-Dec-13 03 | ||
+ | 115 2021-Dec-13 04 | ||
</ | </ | ||
</ | </ | ||
줄 61: | 줄 64: | ||
</ | </ | ||
</ | </ | ||
+ | |||
+ | ===== Request Query 분석 스크립트 ===== | ||
+ | |||
+ | <WRAP prewrap> | ||
+ | <code vim> | ||
+ | #!/bin/bash | ||
+ | |||
+ | ###### SETUP ############ | ||
+ | LOG_FOLDER=/ | ||
+ | ACCESS_LOG=$LOG_FOLDER/ | ||
+ | |||
+ | HOW_MANY_ROWS=20000 | ||
+ | |||
+ | |||
+ | |||
+ | ######### FUNCTIONS ############## | ||
+ | |||
+ | |||
+ | function title() { | ||
+ | echo " | ||
+ | --------------------------------- | ||
+ | $@ | ||
+ | --------------------------------- | ||
+ | " | ||
+ | } | ||
+ | |||
+ | function urls_by_ip() { | ||
+ | local IP=$1 | ||
+ | tail -5000 $ACCESS_LOG | awk -v ip=$IP ' $1 ~ ip {freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20 | ||
+ | } | ||
+ | |||
+ | |||
+ | function ip_addresses_by_user_agent(){ | ||
+ | local USERAGENT_STRING=" | ||
+ | local TOP_20_IPS=" | ||
+ | echo " | ||
+ | } | ||
+ | |||
+ | ####### RUN REPORTS ############# | ||
+ | |||
+ | |||
+ | title "top 20 URLs" | ||
+ | TOP_20_URLS=" | ||
+ | echo " | ||
+ | |||
+ | |||
+ | title "top 20 URLS excluding POST data" | ||
+ | TOP_20_URLS_WITHOUT_POST=" | ||
+ | echo " | ||
+ | |||
+ | |||
+ | title "top 20 IPs" | ||
+ | TOP_20_IPS=" | ||
+ | echo " | ||
+ | |||
+ | title "top 20 user agents" | ||
+ | TOP_20_USER_AGENTS=" | ||
+ | echo " | ||
+ | |||
+ | |||
+ | title "IP Addresses for Top 3 User Agents" | ||
+ | |||
+ | for ((I=1; I<=3; I++)) | ||
+ | do | ||
+ | UA=" | ||
+ | echo " | ||
+ | echo " | ||
+ | ip_addresses_by_user_agent " | ||
+ | echo " | ||
+ | " | ||
+ | done | ||
+ | </ | ||
+ | </ | ||
+ | |||
+ | * Top 20 URLs | ||
+ | * Top 20 URLs exclude POST | ||
+ | * Top 20 Remote IPs | ||
+ | * Top 20 User-Agent | ||
+ | |||