Skip to content
ohsudo, Home

Module 2: Text and logs

Count and sort: wc, cut, sort and uniq

Here's a question you'll really get: who is hitting this server the most? You'll build the answer one piece at a time, on a real access log.

● Runs 100% in your browser. Nothing here can harm a real system.

Step 1 of 6

How many requests?

wc -l counts the lines in a file. In a web server log, each line is one request.

Your task

Count the lines in access.log.

guest@ohsudo: ~ — Ubuntu 24.04

Starting the terminal…

What you'll practice

  1. How many requests?. wc -l counts the lines in a file. In a web server log, each line is one request.
  2. Take one column. cut takes columns: -d says what separates them, and -f which one you want. Here the IP address is the first, separated by spaces.
  3. Put them in order. sort orders lines. Pipe the column into it.
  4. Count the repeats. uniq -c collapses repeated lines and counts them. It only sees lines next to each other, which is why you sort first.
  5. Biggest first. sort -n sorts as numbers, and -r reverses the order. That's your answer: 203.0.113.7 made the most requests.
  6. The same for status codes. The same pipeline works on any column. In this log format, the status code is column 9. A lot of 500 means your application is failing.

See also