Server Load Troubleshooting Commands

Use these commands to analyze traffic spikes, identify abusive IPs, and diagnose server load issues.

Username: USERNAME

Run From: /home/USERNAME

Logs: /home/USERNAME/access-logs/

Commands

cd /home/USERNAME

awk '{print $4}' ./access-logs/* | sed 's/\[//' | sort | head -n 1

awk '{print $1}' ./access-logs/* | sort -u | wc -l

awk '{print $1}' ./access-logs/* | sort | uniq -c | sort -nr | head -n 25

awk '{print $7}' ./access-logs/* | sed 's/?[^ ]*//' | sort | uniq -c | sort -nr | head -n 10

EARLIEST=$(awk '{print $4}' ./access-logs/* | sed 's/\[//' | sort | head -n 1)
grep "$EARLIEST" ./access-logs/*

geoiplookup IP_ADDRESS

awk -F\" '{print $6}' ./access-logs/* | sort | uniq -c | sort -nr | head -n 20

awk '{print $4}' ./access-logs/* | cut -d: -f1-3 | sed 's/\[//' | sort | uniq -c | sort -nr | head

awk -F\" '{print $4}' ./access-logs/* | grep -v "-" | sort | uniq -c | sort -nr | head -n 20

awk '$9 ~ /^(200|206)$/' ./access-logs/* | awk '{print $1}' | sort | uniq -c | sort -nr | head

grep "cgi-bin" ./access-logs/* | awk '{print $1}' | sort | uniq -c | sort -nr | head

awk '{print $10}' ./access-logs/* | sort -nr | head