Shell Programming and Scripting

#!/bin/sh
FILES=/data/log/access_*.log
for f in $FILES
do
echo "Processing $f file"
cat $f | awk '{print $1}' | sort | uniq -c | sort -n | tail
done

Processing /data/log/access_abc.log file
     
    114 1.1.1.1
    167 2.2.2.2
   2258 3.3.3.3
Processing /data/log/access_def.log file
    102 1.1.1.1
    102 2.2.2.2
   2040 3.3.3.3

1.1.1.1 - - [01/Jul/2015:10:59:29 -0400] 
         "GET /themes/warehouse/img/arrow_right_2.png HTTP/1.1" 200 149 
         "http://www.abcd.com/content/152-Tea_Tree_Oil_Uses_sp_153" 
         "Mozilla/5.0 (iPad; CPU OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12F69 Safari/600.1.4"

awk ' 
NR==1           {split (START, T, ":")
                 START=T[1]*60+T[2]
                 split (STOP, T, ":")
                 STOP=T[1]*60+T[2]
                }

FNR==1          {print "processing " FILENAME " file"}

                {sub (/\[/, _, $4)
                 split ($4, T, ":")
                 TIME=60*T[2]+T[3]
                }

DAY=T[1] &&
TIME >= START &&
TIME <= STOP    {print FILENAME, $1}
' DAY="01/Jul/2015" START="10:50" STOP="10:59" $FILES

#!/bin/bash

if (( $# < 3 || $# > 4 ))
then
   printf "Usage: $0 from_date from_time [to_date] to_time\n" >&2
   exit 2
fi

FDAY=$1
FTIME=$2

if (( $# == 3 ))
then
    TDAY=$FDAY
    TTIME=$3
else
    TDAY=$4
    TTIME=$3
fi

FROM=$(date -d "$FDAY $FTIME" +%s)
(($? != 0 )) && exit 3
TO=$(date -d "$TDAY $TTIME" +%s)
(($? != 0 )) && exit 4

if (( $# == 3 && TO < FROM ))
then
   #FROM time later that TO time so add a day
   (( TO+=3600*24))
fi

if (( TO < FROM ))
then
    echo "$0: FROM date must be before TO date" >&2
    exit 5
fi


echo "Examining from $(date -d @$FROM) ($FROM)"
echo "            to $(date -d @$TO) ($TO)"
echo
FILES=/data/log/access_*.log

gawk -v F=$FROM -v T=$TO -v debug=0 '
FNR==1 {
    for(ip in C) printf "%7d %s\n", C[ip], ip
    delete C
    print "Processing " FILENAME " file"
}
$NF == "-0400]" {
  split($(NF-1),v,"[[/: ]")
  mnum=int(index("JanFebMarAprMayJunJulAugSepOctNovDec", v[3])/3)
  tm=mktime(v[4] " " mnum " " v[2] " " v[5] " " v[6] " " v[7])

  if (tm >= F && tm <= T) C[$1]++
  else if(debug) print tm " not between " F " and " T
}
END {for(ip in C) printf "%7d %s\n", C[ip], ip} ' $FILES

$ ./logcount "1 June 2015" 10:30 2:00
Examining FROM Mon, Jun 01, 2015 10:30:00 AM (1433118600)
            TO Tue, Jun 02, 2015  2:00:00 AM (1433174400)

Processing /data/log/access_abc.log file
    114 1.1.1.1
    167 2.2.2.2
   2258 3.3.3.3
Processing /data/log/access_def.log file
    102 1.1.1.1
    102 2.2.2.2
   2040 3.3.3.3