how to know number of access to "Xfile" using http*?

Support for security such as Firewalls and securing linux
Post Reply
Windows
Posts: 59
Joined: 2021/06/16 13:20:01

how to know number of access to "Xfile" using http*?

Post by Windows » 2022/05/30 18:51:36

hello,

some command as

Code: Select all

cat /var/log/httpd/access_log | grep 'myprogram.exe'
for get number of acces to my file from WEB?

and if I have N programs? (program_version1.exe, program_version2, program_july_2022.exe, ...)

is valid run:

Code: Select all

cat /var/log/httpd/access_log | grep '*program*.exe'
???

User avatar
TrevorH
Site Admin
Posts: 33216
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: how to know number of access to "Xfile" using http* ?

Post by TrevorH » 2022/05/30 20:24:04

cat /var/log/httpd/access_log | grep '*program*.exe'
This is what is known as a 'useless use of cat' since it's entirely unnecessary. And, yes, grep can take a pattern for the string you want to search for. It will also quite happily just return the _count_ of the number of hits it finds without listing them all - since your question says you want to know the number of accesses.

So something like

Code: Select all

grep -c 'program.*\.exe'  /var/log/httpd/access_log
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

Whoever
Posts: 1361
Joined: 2013/09/06 03:12:10

Re: how to know number of access to "Xfile" using http* ?

Post by Whoever » 2022/05/30 20:29:50

Windows wrote:
2022/05/30 18:51:36

is valid run:

Code: Select all

cat /var/log/httpd/access_log | grep '*program*.exe'
???
Adding to what Trevor said: grep does not use globs/wildcards. It uses regular expressions (different regex formats can be selected with command line options). So "*" just means 0 or more instances of the prior character, which means, when used after the "m", zero or more "m" characters. The "." means any character.

Windows
Posts: 59
Joined: 2021/06/16 13:20:01

Re: how to know number of access to "Xfile" using http*?

Post by Windows » 2022/05/31 10:41:01

thanks,
many times I was open (download) the file https://web.com/downloads/program_version1.exe
but when I run

Code: Select all

grep -c 'program.*\.exe'  /var/log/httpd/access_log
the result is

Code: Select all

[root@centos ~]# grep -c 'program.*\.exe'  /var/log/httpd/access_log
0
[root@centos ~]#
my config in apache is wrong?

User avatar
TrevorH
Site Admin
Posts: 33216
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: how to know number of access to "Xfile" using http*?

Post by TrevorH » 2022/05/31 12:09:21

Who knows! Try the grep witout the -c and change the pattern to search for to the exact name of the thing you downloaded. If it doesn't show up then either you're not on the right server or you're looking at the wrong log file.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

Whoever
Posts: 1361
Joined: 2013/09/06 03:12:10

Re: how to know number of access to "Xfile" using http*?

Post by Whoever » 2022/05/31 16:51:53

Windows wrote:
2022/05/31 10:41:01
thanks,
many times I was open (download) the file https://web.com/downloads/program_version1.exe
but when I run

Code: Select all

grep -c 'program.*\.exe'  /var/log/httpd/access_log
the result is

Code: Select all

[root@centos ~]# grep -c 'program.*\.exe'  /var/log/httpd/access_log
0
[root@centos ~]#
my config in apache is wrong?
You are downloading from an https URL. The logs for this probably go into a different file.

User avatar
jlehtone
Posts: 4531
Joined: 2007/12/11 08:17:33
Location: Finland

Re: how to know number of access to "Xfile" using http*?

Post by jlehtone » 2022/05/31 19:10:45

If log entries are in some file in /var/log/httpd/, then:

Code: Select all

grep -r 'program.*\.exe'  /var/log/httpd
That is, recursively check every file under that directory. Alternatively:

Code: Select all

grep 'program.*\.exe'  /var/log/httpd/*
each file in that directory (since we don't care about subdirectories).

Either way, the output contains also filename for each match.
When you know which file has something, you can start to count that file.

Whoever
Posts: 1361
Joined: 2013/09/06 03:12:10

Re: how to know number of access to "Xfile" using http*?

Post by Whoever » 2022/05/31 19:46:49

jlehtone wrote:
2022/05/31 19:10:45
If log entries are in some file in /var/log/httpd/, then:

Code: Select all

grep -r 'program.*\.exe'  /var/log/httpd
That is, recursively check every file under that directory. Alternatively:

Code: Select all

grep 'program.*\.exe'  /var/log/httpd/*
each file in that directory (since we don't care about subdirectories).

Either way, the output contains also filename for each match.
When you know which file has something, you can start to count that file.
Probably want to use "zgrep", not "grep", because older log files are probably compressed.

User avatar
TrevorH
Site Admin
Posts: 33216
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: how to know number of access to "Xfile" using http*?

Post by TrevorH » 2022/05/31 23:46:01

The suggestion about the log file name is good - the default log file for SSL access is ssl_access_log.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

User avatar
jlehtone
Posts: 4531
Joined: 2007/12/11 08:17:33
Location: Finland

Re: how to know number of access to "Xfile" using http*?

Post by jlehtone » 2022/06/01 07:05:06

Whoever wrote:
2022/05/31 19:46:49
Probably want to use "zgrep", not "grep", because older log files are probably compressed.
That is a very good point and applies more generally to logs too, not just to httpd.

Although:
* If one is not interested in older logs, then skipping them due to compression is ok.
* The default logrotate rules in CentOS 7 do not have 'compress' on.


The default 'ssl.conf' sets some filenames for HTTPS:

Code: Select all

# grep -A1 "^[^# ].*Log" /etc/httpd/conf.d/*
/etc/httpd/conf.d/ssl.conf:ErrorLog logs/ssl_error_log
/etc/httpd/conf.d/ssl.conf:TransferLog logs/ssl_access_log
/etc/httpd/conf.d/ssl.conf-LogLevel warn
--
/etc/httpd/conf.d/ssl.conf:CustomLog logs/ssl_request_log \
/etc/httpd/conf.d/ssl.conf-          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
The logs/ssl_access_log is from Apache's viewpoint and is /var/log/httpd/ssl_access_log to us.

Post Reply