title: Filter log file entries based on date range
body: <p>My server is having unusually high CPU usage, and I can see Apache is using way too much memory.
  I have a feeling, I'm being DOS'd by a single IP - maybe you can help me find the attacker?</p>
  <p>I've used the following line, to find the 10 most &quot;active&quot; IPs:</p>
  <pre><code>cat access.log | awk '{print $1}' |sort  |uniq -c |sort -n |tail
  </code></pre>
  <p>The top 5 IPs have about 200 times as many requests to the server, as the &quot;average&quot; user. However, I can't find out if these 5 are just very frequent visitors, or they are attacking the servers.</p>
  <p>Is there are way, to specify the above search to a time interval, eg. the last two hours OR between 10-12 today?</p>
  <p>Cheers!</p>
  <p><strong>UPDATED 23 OCT 2011 - The commands I needed:</strong></p>
  <p>Get entries within last X hours [Here two hours]</p>
  <pre><code>awk -vDate=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 &gt; Date) print Date FS $4}' access.log
  </code></pre>
  <p>Get most active IPs within the last X hours [Here two hours]</p>
  <pre><code>awk -vDate=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 &gt; Date) print $1}' access.log | sort  |uniq -c |sort -n | tail
  </code></pre>
  <p>Get entries within relative timespan</p>
  <pre><code>awk -vDate=`date -d'now-4 hours' +[%d/%b/%Y:%H:%M:%S` -vDate2=`date -d'now-2 hours' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 &gt; Date &amp;&amp; $4 &lt; Date2) print Date FS Date2 FS $4}' access.log
  </code></pre>
  <p>Get entries within absolute timespan</p>
  <pre><code>awk -vDate=`date -d '13:20' +[%d/%b/%Y:%H:%M:%S` -vDate2=`date -d'13:30' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 &gt; Date &amp;&amp; $4 &lt; Date2) print $0}' access.log 
  </code></pre>
  <p>Get most active IPs within absolute timespan</p>
  <pre><code>awk -vDate=`date -d '13:20' +[%d/%b/%Y:%H:%M:%S` -vDate2=`date -d'13:30' +[%d/%b/%Y:%H:%M:%S` ' { if ($4 &gt; Date &amp;&amp; $4 &lt; Date2) print $1}' access.log | sort  |uniq -c |sort -n | tail
  </code></pre>