How to determine which IP addresses are hitting your web site the most如何确定哪些IP地址触及你的网站最

This is a brief one.这是一个简短的一个。 Thanks to由于 The How-To Geek该如何对怪胎 for bringing this command into my troubleshooting repertoire.为使这一命令到我的疑难排解曲目。

A bit of background first.一点背景第一。 This command is helpful to determine who is causing the most hits to your web site.此命令是帮助确定谁是造成最多安打到您的网站。 On my music blog, I post a fair number of (totally legal) MP3s.在我的音乐博客，我后一个公平人数（完全合法）的MP3 。 Some less than ethical people often use those MP3s to stream via their site, causing mine to be slower (and a larger bandwidth bill).有些不到道德的人往往利用这些流的MP3通过其网站，导致矿井要慢（和更大的带宽法案） 。 By figuring out the IP address of the site/person “stealing” my bandwidth I can then block their IP from accessing any of my content.据搞清楚的IP地址的网站/人“窃取”我的带宽然后我可以阻止他们的IP访问我的任何内容。

Note: you’ll need shell access to your web server log files 注意：您需要壳访问您的Web服务器日志文件

1. SSH (or telnet) to your web host.的SSH （或telnet ）您的网页主机。 Switch to the directory that stores your web server log files.切换到目录商店您的Web服务器日志文件。
2. Run this command:运行此命令：

   tail -100000 access.log | awk '{print $1}' | sort | uniq -c |sort -n尾-100000 access.log | awk ' （打印$ 1 ） ' |分类| uniq醇|排序正

   where 100000 is the number of lines (starting from the end of the log file) you want to search, and access.log is the name of your web server access log.其中100000是行数（从末日志文件）您想搜索，并access.log的名称是您的Web服务器访问日志。



3. The result will be a (probably) fairly long list of IPs, sorted by fewest hits to most.其结果将是一个（也许）相当长的名单，地址，按最少安打最。 The first value in each row is the number of times the IP address (the second number) accessed your site (in the number of lines of the log file you specified).第一价值是每行的次数的IP地址（第二号）访问您的网站（在一些线路的日志文件您所指定） 。

   Use the host command to determine the fully qualified domain name of any IP address that shows up (you’ll probably want to know who the ones that hit your site the most are). 使用主机的命令，以确定完全合格的域名的任何IP地址显示（您可能会想知道谁是那些触及您的网站大多是） 。 In the screenshot example below, two of the IPs that hit simplehelp.net the most were Googlebot and the Yahoo Site Crawler.在截图下面的例子，有两个IP地址击中simplehelp.net最被Googlebot和雅虎网站的履带。



4. If there’s an IP/domain that looks suspicious, you can check to see which files they were hitting by using the command:如果有一个IP /网域，看起来可疑，您可以查看哪些文件触及他们使用的命令：

   tail -1000 access.log | grep xx.xx.xx.xx尾-1000 access.log | grep xx.xx.xx.xx

   In that command, 1000 is the number of lines to check, access.log is the name of your web server access log, and xx.xx.xx.xx is the IP you want to sort by.在这一命令， 1000是行数，检查， access.log的名称是您的Web服务器访问日志，并xx.xx.xx.xx的IP是要排序的。 I’d suggest using a smaller number (1000 vs. 100000 as used in the first command) as you probably don’t need/want to see every file they accessed.我会建议您使用更小的数目（ 1000与100000中所用的第一个命令）你可能不需要/希望看到他们每个文件访问。 If you do, increase the 1000 number.如果你这样做，增加了1000个号码。 Or, if not very many results show up, that means that they were hitting your site “earlier”, and you’ll want to increase 1000 to a higher number.或者，如果没有很多的结果显示，这意味着他们触及您的网站“早” ，你就会想增加1000到更高的号码。