Apache Access Log IP Address

This article will document how to sort the apache access log IP address list. You may be analyzing the ip addresses in a given apache access log for any number of reasons, including DDOS attacks. We will document a single command to extract the unique IP addresses, count them, and sort them by most seen.

To sort the unique IP addresses by most seen, run the following command.

cat access.log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -10

To breakdown what exactly is going on the command we will work left to right, command to command being piped into the next.

cat access.log – Pipe the output of the access log into…

awk ‘{print $1}’ – print the ip addresses in the first column into…

sort -n – sort numerically into…

uniq -c – make the sort unique values only and pipe into…

sort -nr – reverse the sort and pipe into…

head -10 – Only show the top 10 most seen ip address in the apache access log

The results from the command will show you what ip addresses you should consider blocking or investigating further.

An advanced attacker will likely distribute the source ips in an undetectable manner. In this case it may be best to search for 404 status codes in the access logs.

grep -oP '43\.\d{1,3}\.\d{1,3}\.\d{1,3}' access.log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -200

Alternatively just tail the logs and grep for 404 to help begin finding the pattern of ip addresses.

tail -f access.log | grep " 404 "

Search access logs for IP addresses by the hour

Short of a Security Information and Event (SIEM) tool you may need to filter logs for a given time period on the command line with the raw access log. The simples way is to use awk.

awk '$4 >= "[10/Feb/2025:14:00:00" && $4 <= "[10/Feb/2025:15:00:00"' /var/log/apache2/access.log

You can pipe the results into grep to get the count of a given IP address during that time span.

awk '$4 >= "[10/Feb/2025:14:00:00" && $4 <= "[10/Feb/2025:15:00:00"' /var/log/apache2/access.log | grep -c "1.1.1.1"

Search for IP addresses causing 404 response

A distributed denial of service (DDoS) attack could be detected by searching for IP addresses causing a 404. If you see a single IP or a specific IP range or even an influx of 404 responses out of the blue it could be due to a DDoS attack.

To detect IP addresses causing 404s, run this command.

awk '$9 == 404 {print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -nr

$9 – The HTTP status code field. 404 in this case.

$1 – The IP Address field

sort – organize the IP addresses

uniq -c – count the occurances of the ip address

sort -nr – sort the results in descending order

You can filter the results further by providing a time range. Rather than search the access logs for the entire day, search for the time frame in the current DDoS attack or high resource utilization period.

awk '$4 >= "[10/Feb/2025:14:00:00" && $4 <= "[10/Feb/2025:15:00:00" && $9 == 404 {print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -nr

Conclusion

This article has demonstrated how to sort unique ip address from an apache access log. Let us know in the comments if you have any questions or would like to see more examples about analyzing ip addresses in an access log. If you found this article helpful, read more of our content here.