preg_match_all从apache日志文件中计算ip地址

Question

i am trying to grab ip address from apache log file and count unique ip

this apache log file have 22.22.22.22 more then 10 time and 125.245.25.25 not more then 10 time

i am trying to get ip only more then 10 time have in Apache log file

my PHP code

<?php 
    $iplist_file="/home/domain/public_html/iplist.txt";

    $iplist_file=file_get_contents($iplist_file);

    preg_match_all('/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/',$iplist_file,$a);

    $count = count($a[0]);
    echo "<b>Number of ip</b> = " .$count."<p>";
?>

text file

22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
22.22.22.22 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
125.245.25.25 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
125.245.25.25 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
125.245.25.25 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)
125.245.25.25 - - [21/Jan/2016:17:06:31 +0300] "POST 1.php HTTP/1.1" 200 632 "mydomain.com" "Mozilla/5.0 (PlayStation 4 3.15)

Answer 1

For get all IP from log you can use this very similar regex:

preg_match_all('/^(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/m', $iplist_content, $matches);

Flag m is here for multiline mode (http://php.net/manual/en/reference.pcre.pattern.modifiers.php), ?P<ip> for naming catching group - instead of $matches[1] i have $matches['ip'] (it is not necessary).

As I say, in $matches['ip'] you have all IP founded in log. For count them you can use simple loop, or better you can use fnc array_count_values.

When we put this all together, we get this:

<?php

$iplist_file = "/home/domain/public_html/iplist.txt";
$iplist_content = file_get_contents($iplist_file);

preg_match_all('/^(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/m', $iplist_content, $matches);

foreach (array_count_values($matches['ip']) as $ip => $count) {
    print $ip . ': ' . $count . '<br>';
}