How to determine which IP addresses are hitting your web site the most如何確定哪些IP地址觸及你的網站最

This is a brief one.這是一個簡短的一個。 Thanks to由於 The How-To Geek該如何對怪胎 for bringing this command into my troubleshooting repertoire.為使這一命令到我的疑難排解曲目。

A bit of background first.一點背景第一。 This command is helpful to determine who is causing the most hits to your web site.此命令是幫助確定誰是造成最多安打到您的網站。 On my music blog, I post a fair number of (totally legal) MP3s.在我的音樂博客，我張貼了不少（完全合法）的MP3 。 Some less than ethical people often use those MP3s to stream via their site, causing mine to be slower (and a larger bandwidth bill).有些不到道德的人往往利用這些流的MP3通過其網站，導致礦井要慢（和更大的帶寬法案） 。 By figuring out the IP address of the site/person “stealing” my bandwidth I can then block their IP from accessing any of my content.據搞清楚的IP地址的網站/人“竊取”我的帶寬然後我可以阻止他們的IP訪問我的任何內容。

Note: you’ll need shell access to your web server log files 注意：您需要殼訪問您的Web服務器日誌文件

1. SSH (or telnet) to your web host.的SSH （或telnet ）您的網頁主機。 Switch to the directory that stores your web server log files.切換到目錄商店您的Web服務器日誌文件。
2. Run this command:運行此命令：

   tail -100000 access.log | awk '{print $1}' | sort | uniq -c |sort -n尾-100000 access.log | awk ' （打印1美元） ' |分類| uniq醇|排序正

   where 100000 is the number of lines (starting from the end of the log file) you want to search, and access.log is the name of your web server access log.其中100000是行數（從末日誌文件）您想搜索，並access.log的名稱是您的Web服務器訪問日誌。



3. The result will be a (probably) fairly long list of IPs, sorted by fewest hits to most.其結果將是一個（也許）相當長的名單，地址，按最少安打最。 The first value in each row is the number of times the IP address (the second number) accessed your site (in the number of lines of the log file you specified).第一價值是每行的次數的IP地址（第二號）訪問您的網站（在一些線路的日誌文件您所指定） 。

   Use the host command to determine the fully qualified domain name of any IP address that shows up (you’ll probably want to know who the ones that hit your site the most are). 使用主機的命令，以確定完全合格的域名的任何IP地址顯示（您可能會想知道誰是那些觸及您的網站大多是） 。 In the screenshot example below, two of the IPs that hit simplehelp.net the most were Googlebot and the Yahoo Site Crawler.在屏幕下面的例子，有兩個IP地址擊中simplehelp.net最被Googlebot和雅虎網站的履帶。



4. If there’s an IP/domain that looks suspicious, you can check to see which files they were hitting by using the command:如果有一個IP /網域，看起來可疑，您可以查看哪些文件觸及他們使用的命令：

   tail -1000 access.log | grep xx.xx.xx.xx尾-1000 access.log | grep xx.xx.xx.xx

   In that command, 1000 is the number of lines to check, access.log is the name of your web server access log, and xx.xx.xx.xx is the IP you want to sort by.在這一命令中， 1000是行數，檢查， access.log的名稱是您的Web服務器訪問日誌，並xx.xx.xx.xx的IP是要排序的。 I’d suggest using a smaller number (1000 vs. 100000 as used in the first command) as you probably don’t need/want to see every file they accessed.我會建議您使用更小的數目（ 1000與100000中所用的第一個命令）你可能不需要/希望看到他們每個文件訪問。 If you do, increase the 1000 number.如果你這樣做，增加了1000個號碼。 Or, if not very many results show up, that means that they were hitting your site “earlier”, and you’ll want to increase 1000 to a higher number.或者，如果沒有很多的結果顯示，這意味著他們觸及您的網站“早” ，你就會想增加1000到更高的號碼。