Extract and Count Unique IP Addresses from access.log

Extract unique IP addresses from Nginx access.log file and sort IP addresses based on HTTP requests count. Useful to identify bad IP addresses that flood or DDoS a website.

Get all IP addresses from Nginx access.log:

cat access.log | awk '{print $1}'

Get only unique IP addresses:

cat access.log | awk '{print $1}' | sort | uniq

Get only unique IP addresses and count them:

cat access.log | awk '{print $1}' | sort | uniq -c | sort -nr

Another command is this:

cat access.log | cut -f1 -d ' ' | sort | uniq -c | sort -nr

Example output:

412 66.249.89.XXX 371 66.249.89.XXX 361 66.249.89.XXX 344 31.59.82.XXX 129 85.15.0.XXX  70 151.237.238.XXX  48 66.249.92.XXX  42 212.114.111.XXX  42 212.114.110.XXX  36 212.114.111.XXX  31 95.108.158.XXX  30 68.180.228.XXX  29 46.148.99.XXX  28 95.226.111.XXX  26 68.180.229.XXX