Created
April 22, 2024 12:00
-
-
Save ghotz/1493a05d8acd1d0efa26b80819ac8886 to your computer and use it in GitHub Desktop.
Get top 10 offenders IP for total POSTS count and bytes from http logfiles
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
$Log = Get-Content "C:\home\logfiles\http\rawlogs\*.log" | Select -Skip 2 | ConvertFrom-Csv -Delimiter " " -Header 'date','time','s-sitename','cs-method','cs-uri-stem','cs-uri-query','s-port,cs-username','c-ip','cs(User-Agent)','cs(Cookie)','cs(Referer)','cs-host','sc-status','sc-substatus','sc-win32-status','sc-bytes','cs-bytes','time-taken'; | |
$Log | ? { $_.'cs-method' -eq 'POST' } | Group-object -Property 'cs(User-Agent)' | % {[pscustomobject]@{Type=$_.Name;'Total POSTs ↓'=$_.Count;'Total Bytes' = ($_.group | measure-object 'cs-bytes' -Sum).Sum}} | Sort-Object 'Total POSTs ↓' -Descending | Select -first 10 | ft | |
$Log | ? { $_.'cs-method' -eq 'POST' } | Group-object -Property 'cs(User-Agent)' | % {[pscustomobject]@{Type=$_.Name;'Total POSTs'=$_.Count;'Total Bytes ↓' = ($_.group | measure-object 'cs-bytes' -Sum).Sum}} | Sort-Object 'Total Bytes ↓' -Descending | Select -first 10 | ft |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment