$ Linux One Liners
Back to commands

Hosting Operations

Read-only

See Top Referrers

You need a rough look at which referrers are sending requests.

Command

awk -F'"' '{print $4}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head

Before you run this

System impact: Read-only. Low when scoped to the shown target.

When not to use it: Do not treat referrers as complete analytics; some clients strip or spoof them.

Expected output

A ranked list of referrers.

System impact

Read-only. Nothing changes. The command counts referrer strings.

May require elevated permissions on protected paths or service-owned files.

Recovery / rollback: no state is changed.

When to use it

Use this as a quick server-side sanity check for campaign traffic.

When not to use it

Do not treat referrers as complete analytics; some clients strip or spoof them.

next steps

Related commands

Hosting Operations Read-only

Find Top 404 URLs

The missing file was not random. The access log had a pattern.

awk '$9==404 {print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
Hosting Operations Read-only

Find Unusually Large Web Responses

A few huge responses can explain bandwidth, latency, and suspicious download patterns.

awk '$10 ~ /^[0-9]+$/ && $10 > 1000000 {print $10, $1, $7, $9}' /var/log/nginx/access.log | sort -nr | head
Hosting Operations Read-only

Group Server Errors by URL Path

A 500 spike is easier to triage when the broken path is obvious.

awk '$9 ~ /^5/ {count[$7]++} END {for (path in count) print count[path], path}' /var/log/nginx/access.log | sort -nr | head
Hosting Operations Read-only

Summarize HTTP Status Codes

Before chasing individual lines, get the shape of the whole log.

awk '{count[$9]++} END {for (code in count) print count[code], code}' /var/log/nginx/access.log | sort -nr
Cybersecurity Triage Read-only

Count the Most Common User Agents

A strange traffic spike often has a strange user agent.

awk -F'"' '{print $6}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

  • LPIC-1 style command-line practice
  • LFCS style performance-task practice
  • Linux+ style troubleshooting review

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.