Python脚本: 统计访问Nginx的前100个IP和查询所在国家和城市

脚本 ipinfo.py 读取 iplist.txt 查询IP地址所在国家和城市

# ipinfo.py
import re
import ipdb
import ipaddress

db = ipdb.BaseStation("/app/qqwry.ipdb")

with open("/app/iplist.txt", "r") as f:
    data = f.read()

iplist = re.findall(r"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b", data)
for ip in iplist:
   try:
      ipaddress.ip_address(ip).is_global
      print(ip, db.find(ip, "CN"))
   except:
      pass

"""
# 使用前先安装 ipip-ipdb 库 和 QQ纯真IP表数据
wget https://cdn.jsdelivr.net/npm/qqwry.ipdb/qqwry.ipdb
apt install python3-pip -y
pip3 install --upgrade pip requests
pip3 install ipip-ipdb
"""

Shell 命令查询 nginx-php 容器日志，获得 iplist.txt IP表

docker logs nginx-php \
  | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq -c| sort -nrk 1 \
  | head -n 100 > iplist.txt

docker exec -it python3  python3 /app/ipinfo.py

#   pip3 install beautifulsoup4  html5lib  ipip-ipdb

除了统计网页访问，还可以使用 wgmtu 脚本生成 /var/log/auth.log 的IP表

bash wgmtu ip | tee iplist.txt

# wgmtu 脚本实际使用下面命令
cat /var/log/auth.log \
  | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq -c| sort -nrk 1