grep-suspicious

# IP 
cat access.log | awk '{print $1}' | sort | uniq -c | sort -n | tail -fn 100

# string in request 
zgrep 'string' *.zip | tee /tmp/suspicious.log
grep 'string' /tmp/suspicious.log | awk '{ print $7 }' | sort | uniq -c | sort -n

# http count zwischen 0:00 uhr und 0:10
zcat access.log.1.gz |grep 21/Mar/2017:00:0 > /tmp/000
awk '{print $1}' < /tmp/000 |sort|uniq -c|sort -n|tail