Top 3 Command-Line Tricks to Analyze Apache Access Logs Quickly

1. Top 10 IPs by Access Count

When traffic spikes unexpectedly, the fastest way is to identify the IPs with the most requests and temporarily block them.

# cat access_log | cut -f1 -d " " | sort | uniq -c | sort -k 1 -n -r | head -10

2. Top 10 Most Requested URLs

Knowing which URLs receive the most hits helps target optimization efforts.

# cat access_log | cut -f7 -d " " | sort | uniq -c | sort -k 1 -n -r | head -10

3. Top 10 Largest Requested Resources

Large files can severely affect response time, so identifying them is essential.

# cat access_log | sort -k 10 -n -r | head -10

Command Explanation

The commands are chained with pipes (|) so the output of one becomes the input of the next.

cat : display file contents.

cut : select columns; -d " " sets space as delimiter, -f1 selects the first field.

sort : sort lines; -k chooses column, -n numeric sort, -r reverse order.

uniq : remove duplicate lines; -c prefixes each line with its occurrence count.

head : show the first N lines; -10 shows top 10.

Sample Log Entry

Example lines from an Apache access_log:

183.195.232.39 - - [28/Dec/2015:22:31:48 +0800] "GET /ui-nav.js HTTP/1.1" 304 -
183.195.232.39 - - [28/Dec/2015:22:31:48 +0800] "GET /ui-toggle.js HTTP/1.1" 304 -
183.195.232.38 - - [28/Dec/2015:22:31:48 +0800] "GET /ui-toggle.js HTTP/1.1" 304 -

Running the first command on this log yields the IPs with the highest request counts, demonstrating the step‑by‑step processing of cat, cut, sort, uniq -c, sort -k 1 -n -r, and head -10.