as unixmonkey7109 pointed out, first awk parse replaces three steps.

Prints the unique IP Addresses as they arrive from an Apache `access.log` file. The '-W interactive' tells awk to start writing to stdout immediately and not buffer the output. This command builds on the uniq lines without sorting command (http://www.commandlinefu.com/commands/view/4389/remove-duplicate-entries-in-a-file-without-sorting.)

Puts a splash of color in your access logs. IP addresses are gray, 200 and 304 are green, all 4xx errors are red. Works well with e.g. "colorize access_log | less -R" if you want to see your colors while paging. Use as inspiration for other things you might be tailing, like syslog or vmstat Usage: tail -f access.log | colorize

Depending on your Apache access log configuration you may have to change the sum+=$11 to previous or next awk token. Beware, usually in access log last token is time of response in microseconds, penultimate token is size of response in bytes. You may use this command line to calculate sum and average of responses sizes. You can also refine the egrep regexp to match specific HTTP requests. Show Sample Output

It's not a big line, and it *may not* work for everybody, I guess it depends on the detail of access_log configuration in your httpd.conf. I use it as a prerotate command for logrotate in httpd section so it executes before access_log rotation, everyday at midnight.