Count how many times "petal" has appeared in the logs of all sites on the 10th July, between 09:00 and 14:00:

    egrep "13/Jul/2020:(09|10|11|12|13|14):" /var/www/vhosts/*/logs/access*og | grep petal | wc -l


    Just for home flair, by the hour:

    egrep "13/Jul/2020:09" /var/www/vhosts/homeflairdecor.co.uk/logs/access*og | grep petal | wc -l
    egrep "13/Jul/2020:10" /var/www/vhosts/homeflairdecor.co.uk/logs/access*og | grep petal | wc -l
    egrep "13/Jul/2020:11" /var/www/vhosts/homeflairdecor.co.uk/logs/access*og | grep petal | wc -l


    egrep "13/Jul/2020:(09|10|11|12|13|14):" /var/www/vhosts/*/logs/access*og | grep petal | wc -l




List all the unique IP addresses for log entries containing "petal" on the 13th July, along with the log path:

    grep  "06/Oct/2020"  /var/www/vhosts/*/logs/access*log | grep petal | awk {'print $1'} | sort -u


==========================

Count of the top 20 requests by IP's :

    grep "`date +%d/%b/%Y`" /var/www/vhosts/system/*/logs/access*og | awk '{print $1, $6, $7, $11}' | sort | uniq -c | sort -gr | head -n 20



    grep "`date +%d/%b/%Y`" /var/www/vhosts/system/*/logs/access*og | grep whos | awk '{print $(NF)}' | sort | uniq -c


==========================

DEBUGGING A BUSY SERVER

1) I can see there have been a couple of traffic spikes yesterday at 13:00 and 17:00

    grep '18/Sep/2020' /var/www/vhosts/system/*/logs/access_*log | cut -d[ -f2 | cut -d] -f1 | awk -F: '{print $2":00"}' | sort -n | uniq -c


2) Between 1 and 2PM today, here are the top sites that recieved the most requests:

    for logfile in $(ls /var/www/vhosts/system/*/logs/access_*log) ; do echo $(grep "18/Sep/2020:17" $logfile | wc -l)" "$logfile; done | sort -nr | head -n 5


3) These are the IPs hammering the site the most

    grep '18/Sep/2020:17' /var/www/vhosts/system/rockdoor.com/logs/access_*log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -20

    These are the top file requests by IP, 13:00-14:00

    less /var/www/vhosts/theabi.org.uk/logs/access_ssl_log.processed-20201017.gz | grep 16/Oct/2020:13 | awk '{print $1, $6, $7, $9, $11}' | sort | uniq -c | sort -gr | head -n 20

    OR

    grep "`date +%d/%b/%Y`" /var/www/vhosts/*/logs/access*og | awk '{print $1, $6, $7, $9, $11}' | sort | uniq -c | sort -gr | head -n 20

==========================

Sites that are hitting the PHP max children limit:

    grep -r "server reached max_children setting" /var/log/*php*-fpm* | cut -d' ' -f5 | tr -d ']' | sort | uniq -c | sort -nr

==========================

Requests which had served 200 OK between 10:44-49 and 10:50-53:

    egrep  "24/Jul/2020:10:5(0|3)"  /var/www/vhosts/*/logs/access*og | awk '{print $1, $6, $7, $9, $11}' | grep 200 | sort | uniq -c | sort -gr | wc -l
    109

    egrep  "24/Jul/2020:10:4(4|9)"  /var/www/vhosts/*/logs/access*og | awk '{print $1, $6, $7, $9, $11}' | grep 200 | sort | uniq -c | sort -gr | wc -l
    241


Amount of requests from ahrefs.com:

    egrep  "24/Jul/2020:10"  /var/www/vhosts/*/logs/access*og | grep ahrefs.com | wc -l
    521


Find sites which had been trawled by ahrefs.com:

    egrep  "24/Jul/2020:10"  /var/www/vhosts/*/logs/access*og | grep ahrefs.com | awk '{print $1, $6, $7, $9, $11}' | sort | uniq -c | sort -gr | awk {'print $2'} | sed 's/\:.*$//' | grep -v /access_log| uniq



==========================

List the culprits in the slow query log

     grep "User@Host" /var/log/mariadb-slow.log | grep "User@Host" | awk {'print $3'} | sort -u


=============================================