访问日志名：localhost_access_log.2019-01-29.txt
日志格式示例
192.168.0.1 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1720 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" "sso.test.com" 27.17.66.35 3000 192.168.3.7 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1718 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)" "sso.test.com" 113.0.64.155 5000 192.168.0.51 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.1.1 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.1.8 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.2.1 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1720 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" "sso.test.com" 27.17.66.35 3000 192.168.3.7 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1718 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)" "sso.test.com" 113.0.64.155 5000 192.168.2.51 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.0.1 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.1.8 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.0.1 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1720 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" "sso.test.com" 27.17.66.35 3000 192.168.3.7 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1718 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)" "sso.test.com" 113.0.64.155 5000 192.168.2.51 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.5.1 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000 192.168.6.8 - - [22/Nov/2017:17:26:28 +0800] "GET /images/rand HTTP/1.0" 200 1762 "https://www.test.com/index.shtml" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" "sso.test.com" 183.8.202.141 3000
访问前5的IP以及对应IP访问次数降序排列(因IP在日志中的第一列，所以取$1)
cat localhost_access_log.2019-01-29.txt|awk '{print $1}'|sort |uniq -c|sort -nr|head -10
运行结果
3 192.168.3.7 3 192.168.0.1 2 192.168.2.51 2 192.168.1.8 1 192.168.6.8