Back to lessons

Hosting Operations

See Top Referrers

You need a rough look at which referrers are sending requests.

Command

awk -F'"' '{print $4}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head

What changed

Nothing changes. The command counts referrer strings.

Danger

safe

When to use it

Use this as a quick server-side sanity check for campaign traffic.

When not to use it

Do not treat referrers as complete analytics; some clients strip or spoof them.

Undo or recovery

No state is changed.

Expected output

A ranked list of referrers.

demo script

Disposable terminal steps

  1. awk -F'"' '{print $4}' /var/log/nginx/access.log
  2. awk -F'"' '{print $4}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
  3. tail -n 3 /var/log/nginx/access.log

simulated output

What it looks like

disposable vessel
::fixture-ready::
$ awk -F'"' '{print $4}' /var/log/nginx/access.log
https://www.linkedin.com/
-
-
::exit-code::0
$ awk -F'"' '{print $4}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
      2 -
      1 https://www.linkedin.com/
::exit-code::0
$ tail -n 3 /var/log/nginx/access.log
198.51.100.20 - - [25/Jun/2026:10:01:00 +0000] "GET / HTTP/1.1" 200 512 "https://www.linkedin.com/" "Mozilla/5.0"
198.51.100.21 - - [25/Jun/2026:10:02:00 +0000] "GET /missing.css HTTP/1.1" 404 120 "-" "ScannerBot"
198.51.100.22 - - [25/Jun/2026:10:03:00 +0000] "GET /api HTTP/1.1" 502 90 "-" "curl/8"
::exit-code::0

YouTube Short

Check referrers from access logs.

Platform analytics can be partial. Your server logs can still show referrer clues.

LinkedIn hook

LinkedIn traffic was not a guess. The referrer field showed it.

Question: Do you trust platform analytics, server logs, or both?

experiments

A/B tests to run

Metric: linkedin_comment_rate

A: See top referrers.

B: LinkedIn traffic was not a guess.