{"id":8781,"date":"2022-03-16T10:45:33","date_gmt":"2022-03-16T15:45:33","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=8781"},"modified":"2022-03-16T10:45:34","modified_gmt":"2022-03-16T15:45:34","slug":"apache-httpd-log-file-analysis-hits-by-ip-address","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=8781","title":{"rendered":"Apache HTTPD Log File Analysis &#8212; Hits by IP Address"},"content":{"rendered":"\n<p>When we are decommissioning a website (or web server), I always watch the log files to ensure there aren&#8217;t a lot of people still accessing it. Sometimes there <em>are<\/em> and it&#8217;s worth tracking them down individually to clue them into the site&#8217;s eminent demise. Usually there aren&#8217;t, and it&#8217;s just a confirmation that our decommissioning efforts won&#8217;t be impactful. <\/p>\n\n\n\n<p>This python script looks for IP addresses in the log files and outputs each IP &amp; it&#8217;s access count per log file. Not great if you&#8217;ll see a bunch of IP addresses in the recorded URI string, but it&#8217;s good enough for 99% of our log data. <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: python; title: ; notranslate\" title=\"\">\nimport os\nimport re\nfrom collections import Counter\n\ndef parseApacheHTTPDLog(strLogFile):\n    regexIPAddress = r&#039;\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}&#039;\n\n    with open(strLogFile) as f:\n        objLog = f.read()\n        listIPAddresses = re.findall(regexIPAddress,objLog)\n        counterAccessByIP = Counter(listIPAddresses)\n        for strIP, iAccessCount in counterAccessByIP.items():\n            print(f&quot;{strLogFile}\\t{str(strIP)}\\t{str(iAccessCount)}&quot;)\n\nif __name__ == &#039;__main__&#039;:\n    strLogDirectory = &#039;\/var\/log\/httpd\/&#039;\n    for strFileName in os.listdir(strLogDirectory):\n        if strFileName.__contains__(&quot;access_log&quot;):\n        #if strFileName.__contains__(&quot;hostname.example.com&quot;) and strFileName.__contains__(&quot;access_log&quot;):\n            parseApacheHTTPDLog(f&quot;{strLogDirectory}{strFileName}&quot;)\n\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"<p>When we are decommissioning a website (or web server), I always watch the log files to ensure there aren&#8217;t a lot of people still accessing it. Sometimes there are and it&#8217;s worth tracking them down individually to clue them into the site&#8217;s eminent demise. Usually there aren&#8217;t, and it&#8217;s just a confirmation that our decommissioning &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[1122,352,664],"class_list":["post-8781","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-apache-httpd","tag-httpd","tag-python"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/8781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8781"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/8781\/revisions"}],"predecessor-version":[{"id":8782,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/8781\/revisions\/8782"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}