Count the Most Common User Agents

Traffic changed suddenly and you need a quick view of which client-reported user agents dominate the access log.

Command

awk -F'"' '{print $6}' ./fixtures/nginx/access.log | sort | uniq -c | sort -nr | head

Before you run this

System impact: Read-only. Low when scoped to the shown target.

When not to use it: Do not trust user agents as identity. They are client-supplied strings and can be spoofed or missing.

Expected output

A descending count of user-agent strings, useful as a lead but not as proof of who made the requests.

System impact

Read-only. Nothing changes. The command extracts the user-agent field and counts repeated values; user-agent strings may include unusual client data.

Recovery / rollback: no state is changed.

When to use it

Use this when investigating scraping, monitoring noise, broken clients, or sudden traffic-composition changes.

When not to use it

Do not trust user agents as identity. They are client-supplied strings and can be spoofed or missing.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ awk -F'"' '{print $6}' ./sample-files/nginx/access.log | head

Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
ScannerBot/1.0
ScannerBot/1.0
ScannerBot/1.0
ScannerBot/1.0
ScannerBot/1.0
SyntheticAudit/0.1
SyntheticAudit/0.1

$ awk -F'"' '{print $6}' ./sample-files/nginx/access.log | sort | uniq -c | sort -nr | head

     11 Mozilla/5.0
      5 UptimeCheck/2.0
      5 ScannerBot/1.0
      2 curl/8
      2 SyntheticAudit/0.1

$ awk -F'"' '{print $6}' ./sample-files/nginx/access.log | sort | uniq -c | sort -nr | tail

     11 Mozilla/5.0
      5 UptimeCheck/2.0
      5 ScannerBot/1.0
      2 curl/8
      2 SyntheticAudit/0.1

View commands shown

These are the commands shown in the sanitized transcript.