Counting IPs from a file - linux

I have access logs like this, and I would like to grab each and everyone of them and then order them by which one is found the most.
173.192.238.41 - - [28/Feb/2013:07:06:09 -0500] "GET / HTTP/1.1" 200 20644 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.19; aggregator:Spinn3r (Spinn3r 3.1); http://spinn3r.com/robot) Gecko/2010040121 Firefox/3.0.19"
208.115.113.84 - - [28/Feb/2013:07:06:19 -0500] "GET /tag/bright HTTP/1.1" 404 327 "-" "Mozilla/5.0 (compatible; Ezooms/1.0; ezooms.bot#gmail.com)"
94.228.34.214 - - [28/Feb/2013:07:10:16 -0500] "GET /alli-comes-home-12-10-09-day-224-2264/feed HTTP/1.1" 404 359 "-" "magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)"
209.171.42.71 - - [28/Feb/2013:07:11:19 -0500] "GET /feed/atom HTTP/1.1" 404 326 "-" "Mozilla/5.0 (compatible; BlogScope/1.0; +http://www.blogscope.net/; U of Toronto)"
94.228.34.229 - - [28/Feb/2013:07:12:48 -0500] "GET /the-latest-design-franck-muller-watches-and-versace-watches-6838/feed HTTP/1.1" 404 386 "-" "magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)"
I can to cat and sort it right like this?
cat /path/to/access.log | awk '{print $1}' | sort | uniq -c

You're close. After counting them, you have to sort by the count:
awk '{print $1}' /path/to/access.log | sort | uniq -c | sort -n
You can also do the counting in awk rather than using sort and uniq:
awk '{count[$1]++} END {for (ip in count) print count[ip], ip;}' | sort -n

awk '{a[$1]++}END{for(i in a)print a[i],i}' your_log|sort -rn
or
perl -lane '$x{$F[0]}++;END{for(keys %x){print $x{$_}." ".$_;}}' your_log|sort -rn

Here's one way you can order the IPv4 addresses by occurrence and then by address:
# cut takes only the first column from access.log
<access.log cut -d' ' -f1 |
# Presort the IP addresses so uniq can count them
sort |
uniq -c |
# Format the stream so it only contains `.' delimiters
sed 's/^ *//; s/ /./' |
# Now sort numerically based on each consecutive dot delimited column
sort -t. -k1,1n -k2,2n -k3,3n -k4,4n -k5,5n |
# Reset the first delimter
sed 's/\./ /'
Test input:
cat << EOF > access.log
173.192.238.41 - - [28/Feb/2013:07:06:09 -0500] "GET / HTTP/1.1" 200 20644 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.19; aggregator:Spinn3r (Spinn3r 3.1); http://spinn3r.com/robot) Gecko/2010040121 Firefox/3.0.19"
208.115.113.84 - - [28/Feb/2013:07:06:19 -0500] "GET /tag/bright HTTP/1.1" 404 327 "-" "Mozilla/5.0 (compatible; Ezooms/1.0; ezooms.bot#gmail.com)"
94.228.34.229 - - [28/Feb/2013:07:12:48 -0500] "GET /the-latest-design-franck-muller-watches-and-versace-watches-6838/feed HTTP/1.1" 404 386 "-" "magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)"
94.228.34.214 - - [28/Feb/2013:07:10:16 -0500] "GET /alli-comes-home-12-10-09-day-224-2264/feed HTTP/1.1" 404 359 "-" "magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)"
209.171.42.71 - - [28/Feb/2013:07:11:19 -0500] "GET /feed/atom HTTP/1.1" 404 326 "-" "Mozilla/5.0 (compatible; BlogScope/1.0; +http://www.blogscope.net/; U of Toronto)"
209.71.42.71 - - [28/Feb/2013:07:11:19 -0500] "GET /feed/atom HTTP/1.1" 404 326 "-" "Mozilla/5.0 (compatible; BlogScope/1.0; +http://www.blogscope.net/; U of Toronto)"
94.228.34.229 - - [28/Feb/2013:07:12:48 -0500] "GET /the-latest-design-franck-muller-watches-and-versace-watches-6838/feed HTTP/1.1" 404 386 "-" "magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)"
94.229.34.229 - - [28/Feb/2013:07:12:48 -0500] "GET /the-latest-design-franck-muller-watches-and-versace-watches-6838/feed HTTP/1.1" 404 386 "-" "magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)"
94.227.34.229 - - [28/Feb/2013:07:12:48 -0500] "GET /the-latest-design-franck-muller-watches-and-versace-watches-6838/feed HTTP/1.1" 404 386 "-" "magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)"
EOF
Output:
1 94.227.34.229
1 94.228.34.214
1 94.229.34.229
1 173.192.238.41
1 208.115.113.84
1 209.71.42.71
1 209.171.42.71
2 94.228.34.229

Related

I'm trying to deploy a backend server on elastic beanstalk and when I use the link it get 502 bad gateway

I'm trying to deploy a backend server on elastic beanstalk and when I use the link it get 502 bad gateway
it's a node.js and express server
here is the log output
/var/log/nginx/access.log
----------------------------------------
172.31.90.144 - - [27/Jan/2023:20:20:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:20:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:20:43 +0000] "GET / HTTP/1.1" 502 559 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "41.69.184.245"
172.31.40.18 - - [27/Jan/2023:20:20:44 +0000] "GET /favicon.ico HTTP/1.1" 502 559 "http://project1-env.eba-cjrmrczb.us-east-1.elasticbeanstalk.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "41.69.184.245"
172.31.40.18 - - [27/Jan/2023:20:20:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:20:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:20:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:21:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:21:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:21:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:21:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:21:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:21:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:21:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:21:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:21:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:21:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:21:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:21:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:22:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:22:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:22:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:22:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:22:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:22:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:22:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:22:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:22:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:22:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:22:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:22:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:23:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:23:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:23:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:23:08 +0000] "GET / HTTP/1.1" 502 157 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo#paloaltonetworks.com" "205.210.31.13"
172.31.40.18 - - [27/Jan/2023:20:23:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:23:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:23:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:23:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:23:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:23:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:23:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:23:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:23:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:24:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:24:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:24:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:24:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:24:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:24:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:24:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:24:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:24:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:24:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:24:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:24:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:25:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:25:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:25:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:25:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:25:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:25:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:25:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:25:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:25:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:25:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:25:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:25:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:26:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:26:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:26:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:26:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:26:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:26:20 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:26:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:26:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:26:35 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:26:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:26:50 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:26:51 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:27:05 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:27:06 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:27:06 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:27:21 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:27:21 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:27:21 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:27:36 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:27:36 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:27:36 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:27:51 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:27:51 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:27:51 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:28:06 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:28:06 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:28:06 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.40.18 - - [27/Jan/2023:20:28:21 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:28:21 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.18.237 - - [27/Jan/2023:20:28:21 +0000] "GET / HTTP/1.1" 502 157 "-" "ELB-HealthChecker/2.0" "-"
172.31.90.144 - - [27/Jan/2023:20:28:26 +0000] "GET / HTTP/1.1" 502 559 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "41.69.184.245"
172.31.90.144 - - [27/Jan/2023:20:28:27 +0000] "GET /favicon.ico HTTP/1.1" 502 559 "http://project1-env.eba-cjrmrczb.us-east-1.elasticbeanstalk.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "41.69.184.245"
i have tried to set env variable NPM_CONFIG_PRODUCTION=true but still nothing changed and i have tried to create .ebextensions folder in my root folder and add nodecommand.config but when i do so the project doesn't perform deploy anymore
I solved the problem. It turns out that I forgot to include the dist folder in my deployment.

AWS Elastic Beanstalk status severe but no causes and working well

I have a nodejs apollo server (graphql) and almost all the time the status is severe, but the server is working well. Also, there is no cause information about it.
I have checked all the logs and could not find the reason, anyone has an idea what could be?
access.log
IP - - [22/Dec/2020:09:08:53 +0000] "GET /api/subscriptions HTTP/1.1" 101 27 "-" "-" "IP"
IP - - [22/Dec/2020:09:08:53 +0000] "POST /api/graphql HTTP/1.1" 200 163 "-" "ELB-HealthChecker/2.0" "172.31.37.93, IP"
IP - - [22/Dec/2020:09:08:53 +0000] "POST /api/graphql HTTP/1.1" 200 187 "-" "ELB-HealthChecker/2.0" "172.31.37.93, IP"
IP - - [22/Dec/2020:09:08:53 +0000] "POST /api/graphql HTTP/1.1" 200 187 "-" "ELB-HealthChecker/2.0" "172.31.37.93, IP"
IP - - [22/Dec/2020:09:08:53 +0000] "POST /api/graphql HTTP/1.1" 200 163 "-" "ELB-HealthChecker/2.0" "172.31.37.93, IP"
IP - - [22/Dec/2020:09:08:54 +0000] "GET /api/subscriptions HTTP/1.1" 101 27 "-" "-" "IP"
IP - - [22/Dec/2020:09:08:54 +0000] "GET /api/subscriptions HTTP/1.1" 101 27 "-" "-" "IP"
IP - - [22/Dec/2020:09:08:54 +0000] "GET /api/subscriptions HTTP/1.1" 101 27 "-" "-" "IP"
IP - - [22/Dec/2020:09:08:54 +0000] "GET /api/subscriptions HTTP/1.1" 101 27 "-" "-" "IP"
IP - - [22/Dec/2020:09:08:54 +0000] "GET /api/subscriptions HTTP/1.1" 101 27 "-" "-" "IP"
IP - - [22/Dec/2020:09:08:54 +0000] "GET /api/subscriptions HTTP/1.1" 101 27 "-" "-" "IP"
the health overview pt1:
the health overview pt2:
the monitor of the health:
Could be a linked service such as amazon SNS that has messages in its dead-letter queue. Or a failed deployment. Or something else.. Have you already tried rebuilding the app? AWS EB indeed is sometimes difficult to debug.

No measurements from input from telegraf to influxdb

In short that is my problem:
https://github.com/influxdata/telegraf/issues/4399
I see it wasn't answered, but I also have it.
These are logs from access log. Please help me
192.168.0.122 - - [18/Oct/2018:13:13:40 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:13:50 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:14:00 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:14:10 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:14:20 +0300] "GET /server-status HTTP/1.1" 200 4596 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:14:30 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:14:40 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:14:50 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:15:00 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1"
192.168.0.122 - - [18/Oct/2018:13:15:10 +0300] "GET /server-status HTTP/1.1" 200 4598 "-" "Go-http-client/1.1
The issue was fixed by changing system rights of telegraf service.
Also telegraf does not notify that it cannot read access logs.

How to use AWK regExp to print multiple substring pattern in a excel format in different column

I have a log file which contains millions line like this:
$ cat file.log
10.0.7.92 - - [05/Jun/2017:03:50:06 +0000] "GET /adserver/html5/inwapads/?category=[IAB]&size=320x280&ak=AY1234&output=vast&version=1.1&sleepAfter=&requester=John&adFormat=preappvideo HTTP/1.1" 200 131 "-" "Mozilla/5.0 (Linux; Android 6.0.1; SM-S120VL Build/MMB29M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.83 Mobile Safari/537.36" 0.000 1029 520 127.0.0.1
10.0.6.91 - - [05/Jun/2017:03:50:06 +0000] "GET /adserver/html5/inwapads/?category=[IAB]&output=vast&version=1.1&sleepAfter=&requester=John&size=320x280&ak=AY1234&adFormat=preappvideo HTTP/1.1" 200 131 "-" "Mozilla/5.0 (Linux; Android 6.0.1; SM-S120VL Build/MMB29M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.83 Mobile Safari/537.36" 0.000 1029 520 127.0.0.1
I want print output of every line like this in excel with different columns:
inwapads AY1234 john 320x280
How to do that use awk or do I need to use another method.
If your desired Input looks like the file data:
$ cat file.log
10.0.7.92 - - [05/Jun/2017:03:50:06 +0000] "GET /adserver/html5/inwapads/?category=[IAB]&size=320x280&ak=AY1234&output=vast&version=1.1&sleepAfter=&requester=John&adFormat=preappvideo HTTP/1.1" 200 131 "-" "Mozilla/5.0 (Linux; Android 6.0.1; SM-S120VL Build/MMB29M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.83 Mobile Safari/537.36" 0.000 1029 520 127.0.0.1
10.0.6.91 - - [05/Jun/2017:03:50:06 +0000] "GET /adserver/html5/inwapads/?category=[IAB]&output=vast&version=1.1&sleepAfter=&requester=John&size=320x280&ak=AY1234&adFormat=preappvideo HTTP/1.1" 200 131 "-" "Mozilla/5.0 (Linux; Android 6.0.1; SM-S120VL Build/MMB29M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.83 Mobile Safari/537.36" 0.000 1029 520 127.0.0.1
Then you can simply use awk working on column $7 with some gensub( /regex/, substitution, n, column), awk's general substitution tool
$ awk '{
item=gensub( /(^.*\/)(.*\/)(.*)(\/)(\?.*$)/ , "\\3" , 1, $7 )
ak=gensub( /(^.*ak\=)([A-Z]*[0-9]*)(\&)(.*$)/ , "\\2" , 1, $7)
req=gensub( /(^.*requester\=)([A-Za-z]*)(\&)(.*$)/ , "\\2", 1, $7)
s=gensub( /(^.*size\=)([0-9]*x[0-9]*)(\&.*$)/, "\\2", 1, $7)
print item, ak, req, s
}' file.log
Output:
inwapads AY1234 John 320x280
inwapads AY1234 John 320x280

Select lines by condition with formatted output

In additional for my question
Here is example of log:
10.10.10.10 - - [21/Mar/2016:00:00:00 +0000] "GET /example?page=&per_page=100&scopes= HTTP/1.1" 200 769 "-" "" "1.1.1.1"
10.10.10.10 - - [21/Mar/2016:00:00:00 +0000] "GET /example?page=&per_page=500&scopes= HTTP/1.1" 200 769 "-" "" "1.1.1.1"
10.10.10.10 - - [21/Mar/2016:00:00:00 +0000] "GET /example?page=&per_page=100&scopes= HTTP/1.1" 200 769 "-" "" "1.1.1.1"
11.11.11.11 - - [21/Mar/2016:00:00:00 +0000] "GET /example?page=&per_page=10&scopes= HTTP/1.1" 200 769 "-" "" "1.1.1.1"
12.12.12.12 - - [21/Mar/2016:00:00:00 +0000] "GET /example?page=&per_page=500&scopes= HTTP/1.1" 200 769 "-" "" "1.1.1.1"
13.13.13.13 - - [21/Mar/2016:00:00:00 +0000] "GET /example HTTP/1.1" 200 769 "-" "" "1.1.1.1"
With following command
awk --re-interval '/per_page=[0-9]{3}/{cnt[$1]++} END{for (ip in cnt) print ip, cnt[ip]}' file
I can get counted and groupped result of each IPs witch cosist per_page >= 100 in parameters:
12.12.12.12 1
10.10.10.10 3
How I can modify it for output with per_page parameter value? For example (any format):
12.12.12.12 - per_page-500 - 1
10.10.10.10 - per_page-100 - 2
10.10.10.10 - per_page-500 - 1
awk to the rescue!
$ awk --re-interval -v OFS=' - ' '
match($0,/per_page=[0-9]{3}/){cnt[$1 OFS substr($0, RSTART,RLENGTH)]++}
END{for (ip in cnt) print ip, cnt[ip]}' file
12.12.12.12 - per_page=500 - 1
10.10.10.10 - per_page=500 - 1
10.10.10.10 - per_page=100 - 2

Resources