Question

I am reviewing my access_logs with a statment like:

cat access_log | grep 16/Sep/2012:17 | awk '{print $12 $13 $14 $15 $16}' | sort | uniq -c | sort -n | tail -40

The purpose is to see the user agent of the anyone that has been hitting my server for the last hour sorted by number of hits. My server has unusual activity to I want stop any unwanted spiders/etc.

But the part: awk '{print $12 $13 $14 $15 $16}' would be much preferred as something like: awk '{print $12-through-end-of-line}' so that I could see the whole user agent which is a different length for each one.

Is there a way to do this with awk?

Answer 1

Not extremely elegant, but this works:

grep 16/Sep/2012:17 access_log | awk '{for (i=12;i<=NF;++i) printf "%s ",$i;print ""}'

It has the side effect of condensing multiple spaces between fields down to one, and putting an extra one at the end of the line, though, which probably isn’t critical.