[Unix] Using GeoIP from commandline

GeoIP is not a free database, but a limited versions (countries only) are available freely. Ubuntu packages: geoip-bin, geoip-databases.

I can run it from command-line to get a country statistics for my website for the first ~3.5 months of the year 2021:

i@vps5:~/web/logs/smt.st$ cat access.log.2021-* | grep pdf | cut -f 1 -d ' ' | sort | uniq | xargs -L 1 geoiplookup | sort | uniq -c | sort -r -n | head -20
   1769 GeoIP Country Edition: US, United States
    307 GeoIP Country Edition: DE, Germany
    279 GeoIP Country Edition: RU, Russian Federation
    208 GeoIP Country Edition: FR, France
    208 GeoIP Country Edition: CN, China
    202 GeoIP Country Edition: GB, United Kingdom
    187 GeoIP Country Edition: IN, India
    119 GeoIP Country Edition: CA, Canada
     80 GeoIP Country Edition: NL, Netherlands
     80 GeoIP Country Edition: IP Address not found
     77 GeoIP Country Edition: ES, Spain
     69 GeoIP Country Edition: JP, Japan
     65 GeoIP Country Edition: IT, Italy
     64 GeoIP Country Edition: IE, Ireland
     63 GeoIP Country Edition: UA, Ukraine
     59 GeoIP Country Edition: BR, Brazil
     54 GeoIP Country Edition: PL, Poland
     53 GeoIP Country Edition: KR, Korea, Republic of
     53 GeoIP Country Edition: CZ, Czech Republic
     48 GeoIP Country Edition: SG, Singapore

cat access.log.2021-* -- Apache log files for only this year.

grep pdf -- leave only HTTP requests for pdf files.

cut -f 1 -d ' ' -- leave only first column (IP of host).

sort | uniq -- leave only unique hosts.

xargs -L 1 geoiplookup -- run geoiplookup command for each line in pipe, produce country name to stdout.

sort | uniq -c -- sort all countries and count statistics.

sort -r -n -- sort only first column in stdin (count for each country).

head -20 -- leave only 20 entries.


List of my other blog posts.

Yes, I know about these lousy Disqus ads. Please use adblocker. I would consider to subscribe to 'pro' version of Disqus if the signal/noise ratio in comments would be good enough.