DDOS后Nginx日志攻击IP统计

Nginx日志格式

    log_format main '{ "@timestamp": "$time_local", '
    '"@fields": { '
    '"uri":"$request_uri",'
    '"url":"$uri",'
    '"upstream_addr":"$upstream_addr",'
    '"remote_addr": "$remote_addr", '
    '"remote_user": "$remote_user", '
    '"body_bytes_sent": "$body_bytes_sent", '
    '"host":"$host",'
    '"server_addr":"$server_addr",'
    '"request_time": "$request_time", '
    '"request_time":"$request_time",'
    '"status":"$status",'
    '"request": "$request", '
    '"request_method": "$request_method", '
    '"size":$body_bytes_sent,'
    '"upstream_time":"$upstream_response_time"'
    '"http_referrer": "$http_referer", '
    '"body_bytes_sent":"$body_bytes_sent", '
    '"http_x_forwarded_for": "$http_x_forwarded_for", '
    '"http_user_agent": "$http_user_agent" } }';

将攻击IP单独记录

cat access.log  |grep '"status":"403"' |awk '{match($0,/(remote_addr"[^,]*,)/,a);print a[1]}' > 403.log

将IP排序输出

awk '{sum[$2]+=1} END {for(k in sum) print k ":" sum[k]}' 403.log | sort -n -r -k 2 -t ':' >count.txt

浏览count.txt文件就可以看到所有IP的403出现次数。

相关文档

https://love61v.github.io/2017/07/12/awk%E7%BB%9F%E8%AE%A1%E6%8E%92%E5%90%8D%E5%8D%95%E8%AF%8D%E5%87%BA%E7%8E%B0%E6%AC%A1%E6%95%B0/

https://cloud.tencent.com/developer/article/1414668