'log-analysis/web/group-by.md' ändern

log-analysis/web/group-by.md

@@ -1,2 +1,29 @@
-### Group by IP
-`docker logs reverse-proxy | grep -e "fam\.s-up\.net" | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | sort | uniq -c`
+#### Group by IP since 24h
+```
+docker logs reverse-proxy --since 24h 2>&1 \
+| grep -e "fam\.s-up\.net" \
+| grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" \
+| sort \
+| uniq -c
+```
+
+
+#### Resolve IPs
+```
+for ip in `
+  docker logs reverse-proxy 2>&1 \
+  | grep -e "fam\.s-up\.net" \
+  | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" \
+  | sort \
+  | uniq`; do echo "$ip" `dig -x $ip +short`; done
+```
+
+#### Visites sites
+```
+docker logs reverse-proxy 2>&1 \
+  | grep -e "fam\.s-up\.net" \
+  | grep -oE '[a-z]*.php' \
+  | sort \
+  | uniq -c
+```
+