egrepping mod_security logs

Today I'd like to share a couple of commands to extract interesting information from your mod_security logs.

Lists user agents ordered by the number of occurrences.

egrep 'User-Agent' modsec_audit.log | sort | uniq -c | sort -rn

Lists all HTTP codes in requests

egrep "^HTTP/" modsec_audit.log | sed  "s/HTTP\/[01].[019] //g" | sort | uniq

Lists referrers and counts occurrences.

egrep 'Referer' modsec_audit.log | sort | uniq -c | sort -rn

And simple variations to see the most attacked scripts.

egrep 'GET' modsec_audit.log | sort | uniq -c | sort -rn

egrep 'POST' modsec_audit.log | sort | uniq -c | sort -rn