repo_accesslog_top.sh

#!/bin/sh

LOG_FILE=/var/log/nginx/repo.access.log
NUM_ROWS=50

cat <<-_EOF
        Top $NUM_ROWS repo access log from `head -n 1 $LOG_FILE|awk '{gsub("\[","",$4);print $4}'` to `tail -n 1 $LOG_FILE|awk '{gsub("\[","",$4);print $4}'`
_EOF

awk '{gsub("\?.*", "", $7); print $1, $7}' $LOG_FILE | sort | uniq -c | \
        sed -e 's/^[ \t]*//' | sort -k1 -rn | head -n $NUM_ROWS | \
        awk '{
                cmd="host "$2
                while ((cmd | getline val) > 0) {
                        split(val, a, " ")
                        h=a[5]
                        if (a[5] ~ "NXDOMAIN") h=$2
                }
                print $1, h, $3
        }'