DE

↑ ↓ select, Enter open, Esc close

Show all requests from one IP address in the access log

harmless rootLogsdebian, ubuntu
Adjust the values, the command updates live
root@server
awk -v ip="203.0.113.10" '$1 == ip' /var/www/vhosts/system/example.com/logs/access_ssl_log | tail -50

Prints only lines whose first column exactly matches the given IP and shows the last 50 of them. Unlike a plain grep, the exact comparison does not accidentally match similar addresses such as 1203.0.113.10. Useful after an IP has stood out in the top list and you want to know what it requests before blocking it.

Also searched as

  • what is this ip doing on my server
  • show requests from one ip
  • filter access log by ip address
  • investigate suspicious ip

Related one-liners

All in Logs

Analyze server errors (5xx) in the access log

#awk '$9 ~ /^5[0-9][0-9]$/ {print $9, $7}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20
harmlessLogs

Count HTTP status codes in the access log

#awk '{print $9}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn
harmlessLogs

Count requests per minute in the access log

#awk '{print substr($4, 2, 17)}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20
harmlessLogs

Filter the access log by time range

#awk -v von="09/Oct/2026:14:00" -v bis="09/Oct/2026:15:00" 'substr($4, 2) >= von && substr($4, 2) < bis' /var/www/vhosts/system/example.com/logs/access_ssl_log
harmlessLogs

Find the most common user agents and bots in the access log

#awk -F'"' '{print $6}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20
harmlessLogs

Find the most frequent 404 errors in the access log

#awk '$9 == 404 {print $7}' /var/www/vhosts/system/example.com/logs/access_ssl_log | sort | uniq -c | sort -rn | head -20
harmlessLogs

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.